Users of SystemTap please be advised of an Important Security Update that has been identified.
To view this vulnerability, possible remedies, and others please check out the Security Advisories at Critical Watch (http://criticalwatch.com/support/security-advisories.aspx)
Amplify’d from www.criticalwatch.com
RHSA-2010:0894-01: [RHSA-2010:0894-01] Important: systemtap security update
Product: Red Hat Enterprise Linux
Description:
SystemTap is an instrumentation system for systems running the Linux
kernel, version 2.6. Developers can write scripts to collect data on the
operation of the system. staprun, the SystemTap runtime tool, is used for
managing SystemTap kernel modules (for example, loading them).
It was discovered that staprun did not properly sanitize the environment
before executing the modprobe command to load an additional kernel module.
A local, unprivileged user could use this flaw to escalate their
privileges. (CVE-2010-4170)
It was discovered that staprun did not check if the module to be unloaded
was previously loaded by SystemTap. A local, unprivileged user could use
this flaw to unload an arbitrary kernel module that was not in use.
(CVE-2010-4171)
Read more at www.criticalwatch.com
See this Amp at http://bit.ly/buI0lY
No comments:
Post a Comment