Arbitrary File Creation Vulnerability in OProfile's do_dump_data Function

CVE-2011-2473 · MEDIUM Severity

AV:L/AC:M/AU:N/C:N/I:C/A:C

The do_dump_data function in utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to create or overwrite arbitrary files via a crafted --session-dir argument in conjunction with a symlink attack on the opd_pipe file, a different vulnerability than CVE-2011-1760.

Learn more about our User Device Pen Test.