6.3 - CVE-2009-0784

Executive Summary

Informations
Name	CVE-2009-0784	First vendor Publication	2009-03-25
Vendor	Cve	Last vendor Modification	2020-11-04

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:M/Au:N/C:N/I:C/A:C)
Cvss Base Score	6.3	Attack Range	Local
Cvss Impact Score	9.2	Attack Complexity	Medium
Cvss Expoit Score	3.4	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local users in the stapusr group to insert arbitrary SystemTap kernel modules and gain privileges via unknown vectors.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0784

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-362	Race Condition

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11613

Oval ID:	oval:org.mitre.oval:def:11613
Title:	Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local users in the stapusr group to insert arbitrary SystemTap kernel modules and gain privileges via unknown vectors.
Description:	Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local users in the stapusr group to insert arbitrary SystemTap kernel modules and gain privileges via unknown vectors.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-0784	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section systemtap-runtime is earlier than 0:0.6.2-2.el4_7 AND systemtap-testsuite is earlier than 0:0.6.2-2.el4_7 AND systemtap is earlier than 0:0.6.2-2.el4_7 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section systemtap-runtime is earlier than 0:0.7.2-3.el5_3 AND systemtap-testsuite is earlier than 0:0.7.2-3.el5_3 AND systemtap-client is earlier than 0:0.7.2-3.el5_3 AND systemtap is earlier than 0:0.7.2-3.el5_3 AND systemtap-server is earlier than 0:0.7.2-3.el5_3

Definition Id: oval:org.mitre.oval:def:13814

Oval ID:	oval:org.mitre.oval:def:13814
Title:	DSA-1755-1 systemtap -- race condition
Description:	Erik Sjoelund discovered that a race condition in the stap tool shipped by Systemtap, an instrumentation system for Linux 2.6, allows local privilege escalation for members of the stapusr group. The old stable distribution isn’t affected. For the stable distribution, this problem has been fixed in version 0.0.20080705-1+lenny1. For the unstable distribution, this problem has been fixed in version 0.0.20090314-2. We recommend that you upgrade your systemtap package.
Family:	unix	Class:	patch
Reference(s):	DSA-1755-1 CVE-2009-0784	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	systemtap
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is ia64 AND Installed architecture is arm AND systemtap DPKG is earlier than 0.0.20080705-1+lenny1

Definition Id: oval:org.mitre.oval:def:22797

Oval ID:	oval:org.mitre.oval:def:22797
Title:	ELSA-2009:0373: systemtap security update (Moderate)
Description:	Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local users in the stapusr group to insert arbitrary SystemTap kernel modules and gain privileges via unknown vectors.
Family:	unix	Class:	patch
Reference(s):	ELSA-2009:0373-01 CVE-2009-0784	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	systemtap
Definition Synopsis:
Oracle Linux 5.x rpm test systemtap-testsuite is earlier than 0:0.7.2-3.el5_3 AND systemtap-runtime is earlier than 0:0.7.2-3.el5_3 AND systemtap is earlier than 0:0.7.2-3.el5_3 AND systemtap-client is earlier than 0:0.7.2-3.el5_3 AND systemtap-server is earlier than 0:0.7.2-3.el5_3

Definition Id: oval:org.mitre.oval:def:28954

Oval ID:	oval:org.mitre.oval:def:28954
Title:	RHSA-2009:0373 -- systemtap security update (Moderate)
Description:	Updated systemtap packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SystemTap is an instrumentation infrastructure for systems running version 2.6 of the Linux kernel. SystemTap scripts can collect system operations data, greatly simplifying information gathering. Collected data can then assist in performance measuring, functional testing, and performance and function problem diagnosis.
Family:	unix	Class:	patch
Reference(s):	RHSA-2009:0373 CESA-2009:0373-CentOS 5 CVE-2009-0784	Version:	3
Platform(s):	Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5	Product(s):	systemtap
Definition Synopsis:
Red Hat Enterprise Linux 4 release section The operating system installed on the system is Red Hat Enterprise Linux 4 Packages match section systemtap is earlier than 0:0.6.2-2.el4_7 AND systemtap-runtime is earlier than 0:0.6.2-2.el4_7 AND systemtap-testsuite is earlier than 0:0.6.2-2.el4_7 AND Red Hat Enterprise Linux 5 and CentOS Linux 5 release section Operation system section The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages match section systemtap is earlier than 0:0.7.2-3.el5_3 AND systemtap-client is earlier than 0:0.7.2-3.el5_3 AND systemtap-runtime is earlier than 0:0.7.2-3.el5_3 AND systemtap-server is earlier than 0:0.7.2-3.el5_3 AND systemtap-testsuite is earlier than 0:0.7.2-3.el5_3

Definition Id: oval:org.mitre.oval:def:7772

Oval ID:	oval:org.mitre.oval:def:7772
Title:	DSA-1755 systemtap -- race condition
Description:	Erik Sjoelund discovered that a race condition in the stap tool shipped by Systemtap, an instrumentation system for Linux 2.6, allows local privilege escalation for members of the stapusr group. The old stable distribution (etch) isn't affected.
Family:	unix	Class:	patch
Reference(s):	DSA-1755 CVE-2009-0784	Version:	3
Platform(s):	Debian GNU/Linux 5.0	Product(s):	systemtap
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is ia64 AND Installed architecture is arm AND systemtap is earlier than 0.0.20080705-1+lenny1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Systemtap cpe:2.3:a:systemtap:systemtap:0.0.20090314:::::::* cpe:2.3:a:systemtap:systemtap:0.0.20080705:::::::*	2
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:5.0:::::::* cpe:2.3:o:debian:debian_linux:4.0:::::::*	2

OpenVAS Exploits

Date	Description
2011-08-09	Name : CentOS Update for systemtap CESA-2009:0373 centos4 i386 File : nvt/gb_CESA-2009_0373_systemtap_centos4_i386.nasl
2011-08-09	Name : CentOS Update for systemtap CESA-2009:0373 centos5 i386 File : nvt/gb_CESA-2009_0373_systemtap_centos5_i386.nasl
2009-06-05	Name : Ubuntu USN-743-1 (gs-gpl) File : nvt/ubuntu_743_1.nasl
2009-06-05	Name : Ubuntu USN-744-1 (lcms) File : nvt/ubuntu_744_1.nasl
2009-04-15	Name : CentOS Security Advisory CESA-2009:0373 (systemtap) File : nvt/ovcesa2009_0373.nasl
2009-03-31	Name : RedHat Security Advisory RHSA-2009:0373 File : nvt/RHSA_2009_0373.nasl
2009-03-31	Name : Debian Security Advisory DSA 1755-1 (systemtap) File : nvt/deb_1755_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
53111	SystemTap stap Module Loading Race Condition Local Privilege Escalation

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0373.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090326_systemtap_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2010-01-06	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-0373.nasl - Type : ACT_GATHER_INFO
2009-03-30	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1755.nasl - Type : ACT_GATHER_INFO
2009-03-27	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0373.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
CONFIRM	http://support.avaya.com/elmodocs2/security/ASA-2009-110.htm
DEBIAN	http://www.debian.org/security/2009/dsa-1755
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT	http://www.redhat.com/support/errata/RHSA-2009-0373.html
SECUNIA	http://secunia.com/advisories/34441 http://secunia.com/advisories/34479 http://secunia.com/advisories/34548
VUPEN	http://www.vupen.com/english/advisories/2009/0907

Alert History

If you want to see full details history, please login or register.

Date	Informations
2021-05-04 12:10:09	Multiple Updates
2021-04-22 01:10:33	Multiple Updates
2020-11-04 21:23:17	Multiple Updates
2020-05-23 00:23:26	Multiple Updates
2017-09-29 09:24:06	Multiple Updates
2016-04-26 18:40:41	Multiple Updates
2014-02-17 10:49:04	Multiple Updates
2013-05-10 23:45:29	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	5
CPE ID(s)	4
Sources(s)	8
osvdb(s)	1
Openvas Exploit(s)	7
Nessus® Exploit(s)	5

	Related
6.9	RHSA-2009:0373
6.9	DSA-1755
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)

6.3 - CVE-2009-0784

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU