National Cyber Awareness System

Vulnerability Summary for CVE-2010-0411

Overview

Multiple integer signedness errors in the (1) __get_argv and (2) __get_compat_argv functions in tapset/aux_syscalls.stp in SystemTap 1.1 allow local users to cause a denial of service (script crash, or system crash or hang) via a process with a large number of arguments, leading to a buffer overflow.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=559719

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=559719

External Source: VUPEN

Name: ADV-2010-1001

Hyperlink:http://www.vupen.com/english/advisories/2010/1001

External Source: BID

Name: 38120

Hyperlink:http://www.securityfocus.com/bid/38120

External Source: REDHAT

Name: RHSA-2010:0125

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0125.html

External Source: REDHAT

Name: RHSA-2010:0124

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0124.html

External Source: CONFIRM

Name: http://sourceware.org/git/gitweb.cgi?p=systemtap.git;a=commit;h=a2d399c87a642190f08ede63dc6fc434a5a8363a

Hyperlink:http://sourceware.org/git/gitweb.cgi?p=systemtap.git;a=commit;h=a2d399c87a642190f08ede63dc6fc434a5a8363a

External Source: CONFIRM

Name: http://sourceware.org/bugzilla/show_bug.cgi?id=11234

Hyperlink:http://sourceware.org/bugzilla/show_bug.cgi?id=11234

External Source: SECTRACK

Name: 1023664

Hyperlink:http://securitytracker.com/id?1023664

External Source: SECUNIA

Name: 39656

Hyperlink:http://secunia.com/advisories/39656

External Source: SECUNIA

Name: 38817

Hyperlink:http://secunia.com/advisories/38817

External Source: SECUNIA

Name: 38765

Hyperlink:http://secunia.com/advisories/38765

External Source: SECUNIA

Name: 38680

Hyperlink:http://secunia.com/advisories/38680

External Source: SECUNIA

Name: 38426

Type: Advisory

Hyperlink:http://secunia.com/advisories/38426

External Source: OVAL

Name: oval:org.mitre.oval:def:9675

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9675

External Source: MLIST

Name: [oss-security] 20100204 systemtap DoS issue (CVE-2010-0411)

Hyperlink:http://marc.info/?l=oss-security&m=126530657715364&w=2

External Source: SUSE

Name: SUSE-SR:2010:010

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html

External Source: FEDORA

Name: FEDORA-2010-1720

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035261.html

External Source: FEDORA

Name: FEDORA-2010-1373

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035201.html

References to Check Content

Identifier:oval:org.mitre.oval:def:9675

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9675