1. Forum
  2. Usenet
  3. LINUX.GENTOO.ANNOUNCE

  • [gentoo-announce] [ GLSA 202211-07 ] sysstat: Arbitrary Code Execution

    From [email protected]@21:1/5 to All on Tue Nov 22 05:10:01 2022
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 202211-07
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    https://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Severity: Normal
    Title: sysstat: Arbitrary Code Execution
    Date: November 22, 2022
    Bugs: #880543
    ID: 202211-07

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    An integer overflow vulnerability has been found in sysstat which could
    result in arbitrary code execution.

    Background
    ==========

    sysstat is a package containing a number of performance monitoring
    utilities for Linux, including sar, mpstat, iostat and sa tools.

    Affected packages
    =================

    -------------------------------------------------------------------
    Package / Vulnerable / Unaffected
    -------------------------------------------------------------------
    1 app-admin/sysstat < 12.7.1 >= 12.7.1

    Description
    ===========

    On 32 bit systems, an integer overflow can be triggered when displaying activity data files.

    Impact
    ======

    Arbitrary code execution can be achieved via sufficiently crafted
    malicious input.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All sysstat users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=app-admin/sysstat-12.7.1"

    References
    ==========

    [ 1 ] CVE-2022-39377
    https://nvd.nist.gov/vuln/detail/CVE-2022-39377

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

    https://security.gentoo.org/glsa/202211-07

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users' machines is of utmost
    importance to us. Any security concerns should be addressed to [email protected] or alternatively, you may file a bug at https://bugs.gentoo.org.

    License
    =======

    Copyright 2022 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    https://creativecommons.org/licenses/by-sa/2.5
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmN8R0QACgkQFMQkOaVy +9nyNw//ZTLDRXjctMrn6GtqXWUAoXTrTV23RabcrfFrhCoYLtHuv2kKJU01Og/b e9Xen0UqHsNcBhB6qzbB4Ap9pewn5lQ0fwgdzjFoFEDeOmxqYzTQcKWP9FytUr4E r1ZTSIoN95Wm86hpLrtesMAPG2cR6L+UwP1FCvxlOib2ktJke0mQmjBcVyV1cOao UouVyU3gn83tNPpLEm8/a0JGLm8nL5kLSR4xOIqzdo23K6LiFJ8pL/e6rkJeModT atAVk6BOzCMWPAJiWl2GyxVmaBrqcfuLxFh8nMz5fETuXg87Hlm0L3EuSseiAHLS pmnNe3wyaRWZb3DeRCNV1WKSzsul7/73iJQPc7oGPjmS9Z2zDh7OowIzBx82lvsS poQKf3N1qqY68qppM0PhMBu/qZumonlmz54Pgzozi8HntWX0zFOYkDvzx4c96eoQ BMRVmxrmXraHZKncJhIRA29IV3BGzSZw/kTYfe4JO5og7pwIy0oqThLaeH2MMpi6 F7B+H2VaAB9nxkYe4ugJ5zvTuLIKBTXyUCDoHIAUXMehOt13SKoi0frDDTonnOuQ /Jp1TR4ih07qtDp2kSjvd2VF+8VNiafruELj2sRVYFNvBZRxrMn/PZULtYLAOz2Q dzLrqtPJuyTgNYZyQ1b6vd9pcPz1hSZ+e9Qj3TaJXSasYQ4VSbc=
    =SFec
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)