PT-2011-3894 · Oprofile · Oprofile

Huzaifa S. Sidhpurwala + 1 · Publicado 2011-06-09 · Atualizado 2017-08-29 · CVE-2011-2471

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OProfile versions 0.9.6 and earlier

Description The issue allows local users to potentially gain privileges through shell metacharacters in certain arguments, including the --vmlinux, --session-dir, and --xen arguments. This is related to the daemonrc file and the do save setup and do load setup functions.

Recommendations For OProfile versions 0.9.6 and earlier, consider restricting access to the utils/opcontrol utility until a fix is available. As a temporary workaround, avoid using shell metacharacters in the --vmlinux, --session-dir, and --xen arguments to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-2471

Produtos afetados

Oprofile

Referências · 11

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624212 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=700883 · Exploit
• http://openwall.com/lists/oss-security/2011/05/10/7 · Correção
• http://ubuntu.com/usn/USN-1166-1 · Aviso do Fabricante
• http://debian.org/security/2011/dsa-2254 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/05/03/1 · Nota
• http://openwall.com/lists/oss-security/2011/05/10/6 · Nota
• http://openwall.com/lists/oss-security/2011/05/11/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-2471 · Nota de Segurança
• http://secunia.com/advisories/45205 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67980 · Nota