Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 10.04 LTS USN-1166-1 High Risk: OProfile Command Exploits

ubuntu
Calendar Grey July 11, 2011
Scroller Ubuntu
OProfile issues may permit unapproved operations to execute with elevated permissions, affecting Ubuntu 10.04 LTS. Ensure you update immediately!
OProfile could be made to run programs as an administrator.

Summary

OProfile could be made to run programs as an administrator.

Software Description:

- oprofile: System-wide profiler for Linux systems

Details:

Stephane Chauveau discovered that OProfile did not properly perform input

validation when processing arguments to opcontrol. A local user who is

allowed to run opcontrol with privileges could exploit this to run

arbitrary commands as the privileged user. (CVE-2011-1760, CVE-2011-2471)

Stephane Chauveau discovered a directory traversal vulnerability in

OProfile when processing the --save argument to opcontrol. A local user

could exploit this to overwrite arbitrary files with the privileges of

the user invoking the program. (CVE-2011-2472)

Topics%20covered

Topics Covered

security advisory directory traversal Ubuntu input validation arbitrary commands high risk oprofile

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.04 LTS:
  oprofile                        0.9.6-1ubuntu4.4

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1166-1

CVE-2011-1760, CVE-2011-2471, CVE-2011-2472

Severity
important
Lowest
Low
Medium
High
Critical

July 11, 2011

Topics%20covered

Topics Covered

security advisory directory traversal Ubuntu input validation arbitrary commands high risk oprofile

Package Information

https://launchpad.net/ubuntu/+source/oprofile/0.9.6-1ubuntu4.4

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.