CVE:CVE-2011-1760
CNNVD:CNNVD-201106-055
OProfile 0.9.6及其早期版本的utils/opcontrol存在漏洞。本地用户可以借助-e参数的shell元字符进行eval注入攻击以及获取特权。
solution:Upgrade maynard_johnson oprofile to a higher version than 0.9.6,0.1,0.2,0.3,0.4,0.5,0.5.1,0.5.2,0.5.3,0.5.4,0.6,0.6.1,0.7,0.7.1,0.8,0.8.1,0.8.2,0.9,0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,and avoid the version (,0.9.6],0.1,0.2,0.3,0.4,0.5,0.5.1,0.5.2,0.5.3,0.5.4,0.6,0.6.1,0.7,0.7.1,0.8,0.8.1,0.8.2,0.9,0.9.1,0.9.2,0.9.3,0.9.4,0.9.5