sysstat: Arbitrary Code Execution

Background

sysstat is a package containing a number of performance monitoring utilities for Linux, including sar, mpstat, iostat and sa tools.

Description

On 32 bit systems, an integer overflow can be triggered when displaying activity data files.

Impact

Arbitrary code execution can be achieved via sufficiently crafted malicious input.

Workaround

There is no known workaround at this time.

Resolution

All sysstat users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-admin/sysstat-12.6.2-r1"