RCE in Maynard Johnson Oprofile

CVE-2011-1760

utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to conduct eval injection attacks and gain privileges via shell metacharacters in the -e argument.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.014 (69.0th percentile) — read the EPSS interpretation.

Affected products

Maynard_johnson Oprofile — versions 0.1, 0.2, 0.3
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

secalert@redhat.com (mailing-list, x_refsource_MLIST, Exploit, Patch)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Exploit, Patch)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Exploit, Patch)
secalert@redhat.com (Exploit, vdb-entry, x_refsource_BID)
secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Exploit, Patch)