Re: Re: CVE Request -- oprofile -- Local privilege escalation via crafted opcontrol event parameter when authorized by sudo

[Huzaifa Sidhpurwala <huzaifas () redhat com>]

Hi William,
On 05/01/2011 07:30 AM, William Cohen wrote:
> I don't know if this is the best way to fix this issue, but attached is a patch that filters out all but alpha 
> numeric characters and '_'. Feedback on the patch would be appreciated.

It appears from the debian bug, that there may be others way to exploit
this issue as well. hence i think we need a revised patch?



-- 
Huzaifa Sidhpurwala / Red Hat Security Response Team