Re: CVE-2009-4273 for stap 1.0?

[Dave Brolley <brolley at redhat dot com>]

Hi Tony,

Tony Jones wrote:
> As part of verifying the backport I tried initially to reproduce the problem 
> in the un-fixed code based on the "horror cases" mentioned at: 
> http://sourceware.org/bugzilla/show_bug.cgi?id=11105#c1
>
> I tried various forms based off of the "stap-client -D 'asdf ; ls /etc' ..."
> case but I guess I'm not understanding the side-effects. I assumed the above 
> would result in some form of extraneous output at the client side? 
>
> I guess I'd welcome some concrete examples that demonstrate the exploit if
> you have a spare couple of minutes. Either on or off-list is fine.
>
>
>   
Here is an example which demonstrates the exploit. Running

   stap-client -p1 -B\;ai2

will print an error about -B being an invalid option followed by the 
usage help followed by a message similar to

 /usr/local/bin/stap-server: line 340: ai2: command not found

which indicates that server tried to run the 'ai2' command.

I hope this helps,
Dave