Vulnerability Name:

CVE-2011-1760 (CCN-67212)

Assigned:2011-04-26
Published:2011-04-26
Updated:2011-09-07
Summary:utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to conduct eval injection attacks and gain privileges via shell metacharacters in the -e argument.
CVSS v3 Severity:9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
5.3 Medium (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
5.3 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-94
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: Debian Bug report logs - #624212
arbitrary command execution via sudo opcontrol

Source: CONFIRM
Type: Exploit
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624212

Source: MITRE
Type: CNA
CVE-2011-1760

Source: MLIST
Type: Exploit, Patch
[oss-security] 20110429 CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo

Source: MLIST
Type: Exploit, Patch
[oss-security] 20110430 Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo

Source: MLIST
Type: Exploit, Patch
[oss-security] 20110430 Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo

Source: MLIST
Type: Exploit, Patch
[oss-security] 20110502 Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo

Source: MLIST
Type: Exploit, Patch
[oss-security] 20110503 Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo

Source: MLIST
Type: UNKNOWN
[oss-security] 20110510 Re: Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo

Source: MLIST
Type: Patch
[oss-security] 20110510 Re: Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo

Source: MLIST
Type: UNKNOWN
[oss-security] 20110511 Re: Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo

Source: CCN
Type: OProfile Web site
OProfile - A System Profiler for Linux

Source: SECUNIA
Type: UNKNOWN
44790

Source: SECUNIA
Type: UNKNOWN
45205

Source: DEBIAN
Type: UNKNOWN
DSA-2254

Source: DEBIAN
Type: DSA-2254
oprofile -- command injection

Source: CCN
Type: OSVDB ID: 72792
OProfile utils/opcontrol Shell Metacharacter Eval Injection Local Privilege Escalation

Source: CCN
Type: OSVDB ID: 73716
OProfile utils/opcontrol daemonrc Multiple Argument Shell Metacharacter Local Privilege Escalation

Source: CCN
Type: OSVDB ID: 73717
OProfile utils/opcontrol --save Argument Traversal Arbitrary File Overwrite

Source: CCN
Type: OSVDB ID: 73719
OProfile utils/opcontrol do_dump_data Function --session-dir Argument opd_pipe Symlink Arbitrary File Overwrite

Source: BID
Type: Exploit
47652

Source: CCN
Type: BID-47652
OProfile 'opcontrol' Utility 'set_event()' Local Privilege Escalation Vulnerability

Source: UBUNTU
Type: UNKNOWN
USN-1166-1

Source: CONFIRM
Type: Exploit, Patch
https://bugzilla.redhat.com/show_bug.cgi?id=700883

Source: XF
Type: UNKNOWN
oprofile-setevent-privilege-escalation(67212)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:maynard_johnson:oprofile:0.1:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.2:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.3:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.4:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.5:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.6:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.7:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.8:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.8.1:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.8.2:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.9:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.9.1:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.9.2:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.9.3:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.9.4:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:0.9.5:*:*:*:*:*:*:*
  • OR cpe:/a:maynard_johnson:oprofile:*:*:*:*:*:*:*:* (Version <= 0.9.6)

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:14110
    P
    		USN-1166-1 -- oprofile vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:12839
    P
    		DSA-2254-2 oprofile -- command injection
    2014-06-23
    oval:org.mitre.oval:def:13066
    P
    		DSA-2254-1 oprofile -- command injection
    2014-06-23
    BACK
    maynard_johnson oprofile 0.1
    maynard_johnson oprofile 0.2
    maynard_johnson oprofile 0.3
    maynard_johnson oprofile 0.4
    maynard_johnson oprofile 0.5
    maynard_johnson oprofile 0.5.1
    maynard_johnson oprofile 0.5.2
    maynard_johnson oprofile 0.5.3
    maynard_johnson oprofile 0.5.4
    maynard_johnson oprofile 0.6
    maynard_johnson oprofile 0.6.1
    maynard_johnson oprofile 0.7
    maynard_johnson oprofile 0.7.1
    maynard_johnson oprofile 0.8
    maynard_johnson oprofile 0.8.1
    maynard_johnson oprofile 0.8.2
    maynard_johnson oprofile 0.9
    maynard_johnson oprofile 0.9.1
    maynard_johnson oprofile 0.9.2
    maynard_johnson oprofile 0.9.3
    maynard_johnson oprofile 0.9.4
    maynard_johnson oprofile 0.9.5
    maynard_johnson oprofile *