CVE-2009-0784

Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local users in the stapusr group to insert arbitrary SystemTap kernel modules and gain privileges via unknown vectors.

CVSS v2.0 6.3 MEDIUM

6.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:N/I:C/A:C

Exploitability : 3.4 / Impact : 9.2

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://secunia.com/advisories/34441	Third Party Advisory
http://secunia.com/advisories/34479	Third Party Advisory
http://secunia.com/advisories/34548	Third Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2009-110.htm	Third Party Advisory
http://www.debian.org/security/2009/dsa-1755	Patch Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-0373.html	Third Party Advisory
http://www.vupen.com/english/advisories/2009/0907	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11613	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:systemtap:systemtap:0.0.20080705:::::::*
	cpe:2.3:a:systemtap:systemtap:0.0.20090314:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:4.0:::::::*
	cpe:2.3:o:debian:debian_linux:5.0:::::::*

History

No history.

Information

Published : 2009-03-25 23:30

Updated : 2020-11-04 15:43

NVD link : CVE-2009-0784

Mitre link : CVE-2009-0784

CVE.ORG link : CVE-2009-0784

JSON object : View

Products Affected

systemtap

systemtap

debian

debian_linux

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2009-0784", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.3, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 9.2, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-03-25T23:30:00.187", "references": [{"url": "http://secunia.com/advisories/34441", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/34479", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/34548", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://support.avaya.com/elmodocs2/security/ASA-2009-110.htm", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.debian.org/security/2009/dsa-1755", "tags": ["Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.redhat.com/support/errata/RHSA-2009-0373.html", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.vupen.com/english/advisories/2009/0907", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11613", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local users in the stapusr group to insert arbitrary SystemTap kernel modules and gain privileges via unknown vectors."}, {"lang": "es", "value": "Una condici\u00f3n de carrera en la herramienta stap de SystemTap versiones 0.0.20080705 y 0.0.20090314, permite a los usuarios locales del grupo stapusr insertar m\u00f3dulos de kernel de SystemTap arbitrarios y alcanzar privilegios por medio de vectores desconocidos."}], "lastModified": "2020-11-04T15:43:10.020", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:systemtap:systemtap:0.0.20080705:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF696A11-4FC7-4ECE-B5E3-26B258431803"}, {"criteria": "cpe:2.3:a:systemtap:systemtap:0.0.20090314:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CC37FD4-A179-45E8-8722-A24C3D32CCAE"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F92AB32-E7DE-43F4-B877-1F41FA162EC7"}, {"criteria": "cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C757774-08E7-40AA-B532-6F705C8F7639"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}