|
| News |
|
Red Hat Security Advisory Important: systemtap security update |
| 11-24-2010 |
SystemTap is an instrumentation system for systems running the Linux kernel, version 2.6. Developers can write scripts to collect data on the operation of the system. staprun, the SystemTap runtime tool, is used for managing SystemTap kernel modules (for example, loading them).
Updated systemtap packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6.
The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
It was discovered that staprun did not properly sanitize the environment before executing the modprobe command to load an additional kernel module. A local, unprivileged user could use this flaw to escalate their privileges. (CVE-2010-4170)
Note: After installing the update, users already in the stapdev group must be added to the stapusr group in order to be able to run the staprun tool. SystemTap users should upgrade to these updated packages, which contain backported patches to correct these issues.
Solution:
Before applying the update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network.
Advisory URL: https://rhn.redhat.com/errata/RHSA-2010-0894.html |
| Remember, we listen to you! Any comments/suggestions should be sent to info@serverbuddies.com. |
|
| |
|
|
