Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local users in the stapusr group to insert arbitrary SystemTap kernel modules and gain privileges via unknown vectors.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2009-0373 advisory.

    [0.7.2-3.0.1.el5_3]
    - Add oracle-enterprise.patch

    [0.7.2-3]
    - Resolves: bug #489979, CVE-2009-0784

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A race condition was discovered in SystemTap that could allow users in the stapusr group to elevate privileges to that of members of the stapdev group (and hence root), bypassing directory confinement restrictions and allowing them to insert arbitrary SystemTap kernel modules. (CVE-2009-0784)

Updated systemtap packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SystemTap is an instrumentation infrastructure for systems running version 2.6 of the Linux kernel. SystemTap scripts can collect system operations data, greatly simplifying information gathering. Collected data can then assist in performance measuring, functional testing, and performance and function problem diagnosis.

A race condition was discovered in SystemTap that could allow users in the stapusr group to elevate privileges to that of members of the stapdev group (and hence root), bypassing directory confinement restrictions and allowing them to insert arbitrary SystemTap kernel modules. (CVE-2009-0784)

Note: This issue was only exploitable if another SystemTap kernel module was placed in the 'systemtap/' module directory for the currently running kernel.

Red Hat would like to thank Erik Sjolund for reporting this issue.

SystemTap users should upgrade to these updated packages, which contain a backported patch to correct this issue.

Erik Sjoelund discovered that a race condition in the stap tool shipped by Systemtap, an instrumentation system for Linux 2.6, allows local privilege escalation for members of the stapusr group.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2009:0373 advisory.

    SystemTap is an instrumentation infrastructure for systems running version     2.6 of the Linux kernel. SystemTap scripts can collect system operations     data, greatly simplifying information gathering. Collected data can then     assist in performance measuring, functional testing, and performance and     function problem diagnosis.

    A race condition was discovered in SystemTap that could allow users in the     stapusr group to elevate privileges to that of members of the stapdev group     (and hence root), bypassing directory confinement restrictions and allowing     them to insert arbitrary SystemTap kernel modules. (CVE-2009-0784)

    Note: This issue was only exploitable if another SystemTap kernel module     was placed in the systemtap/ module directory for the currently running     kernel.

    Red Hat would like to thank Erik Sjlund for reporting this issue.

    SystemTap users should upgrade to these updated packages, which contain a     backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
67830	Oracle Linux 5 : systemtap (ELSA-2009-0373)	Nessus	Oracle Linux Local Security Checks	high
60557	Scientific Linux Security Update : systemtap on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43735	CentOS 4 / 5 : systemtap (CESA-2009:0373)	Nessus	CentOS Local Security Checks	medium
36040	Debian DSA-1755-1 : systemtap - race condition	Nessus	Debian Local Security Checks	medium
36032	RHEL 4 / 5 : systemtap (RHSA-2009:0373)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2009-0784

high

Tenable Plugins

high

medium

medium

medium

high