OProfile Multiple Vulnerabilities

This host is installed OProfile and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gboprofilemultvuln.nasl 7024 2017-08-30 11:51:43Z teissa $ OProfile Multiple Vulnerabilities Authors: Madhuri D Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net...

PT-2011-3354

Name of the Vulnerable Software and Affected Versions OProfile versions 0.9.6 and earlier Description The issue allows local users to conduct eval injection attacks and gain privileges via shell metacharacters in the -e argument. This is related to the utils/opcontrol component. Recommendations F...

PT-2011-3895

Name of the Vulnerable Software and Affected Versions OProfile versions 0.9.6 and earlier Description A directory traversal issue exists, potentially allowing local users to overwrite arbitrary files by providing a .. dot dot in the --save argument, related to the --session-dir argument...

PT-2011-3896

Name of the Vulnerable Software and Affected Versions OProfile versions 0.9.6 and earlier Description The issue is related to the do dump data function in utils/opcontrol, which might allow local users to create or overwrite arbitrary files. This can be achieved via a crafted --session-dir argume...

CVE-2011-2473: Improper Link Resolution Before File Access

The dodumpdata function in utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to create or overwrite arbitrary files via a crafted --session-dir argument in conjunction with a symlink attack on the opdpipe file, a different vulnerability than CVE-2011-1760...

CVE-2011-2471: Undefined Security Weakness

utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to gain privileges via shell metacharacters in the 1 --vmlinux, 2 --session-dir, or 3 --xen argument, related to the daemonrc file and the dosavesetup and doloadsetup functions, a different vulnerability than CVE-2011-1760...

CVE-2011-1760: Improper Control of Generation of Code

utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to conduct eval injection attacks and gain privileges via shell metacharacters in the -e argument...

CVE-2011-2472: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to overwrite arbitrary files via a .. dot dot in the --save argument, related to the --session-dir argument, a different vulnerability than CVE-2011-1760...