CVE-2009-4273: Code Injection
A flaw was found in the "stap-server" network compilation server, an optional part of systemtap. Part of the server is written in bash and does not adequately sanitize its inputs, which are essentially full command line parameter sets from a client. Remote users may be able to abuse quoting/spacing/metacharacters to execute shell code on behalf of the compile server process/user (normally a fully unprivileged synthetic userid).
There is currently no fix available. To work-around this issue, avoid running the stap-server program on a network with untrusted users.
[1] http://sourceware.org/PR11105
Other sources
stap-server in SystemTap before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in stap command-line arguments in a request.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4273?
CVE-2009-4273 has a severity rating of important due to its potential for remote command execution.
How do I fix CVE-2009-4273?
To fix CVE-2009-4273, update to SystemTap version 1.1 or later.
What systems are affected by CVE-2009-4273?
CVE-2009-4273 affects SystemTap versions prior to 1.1, including several specific older versions.
Can CVE-2009-4273 be exploited remotely?
Yes, CVE-2009-4273 can be exploited remotely through crafted command-line arguments.
What are the consequences of CVE-2009-4273 exploitation?
Exploitation of CVE-2009-4273 allows attackers to execute arbitrary commands on the affected system.