Executive Summary

Summary
Title acpid security update
Informations
Name DSA-2362 First vendor Publication 2011-12-10
Vendor Debian Last vendor Modification 2011-12-10
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 4.6 Attack Range Local
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple vulnerabilities were found in the acpid, the Advanced Configuration and Power Interface event daemon:

CVE-2011-1159

Vasiliy Kulikov of OpenWall discovered that the socket handling is vulnerable to denial of service.

CVE-2011-2777

Oliver-Tobias Ripka discovered that incorrect process handling in the Debian-specific powerbtn.sh script could lead to local privilege escalation. This issue doesn't affect oldstable. The script is only shipped as an example in /usr/share/doc/acpid/examples. See /usr/share/doc/acpid/README.Debian for details.

CVE-2011-4578

Helmut Grohne and Michael Biebl discovered that acpid sets a umask of 0 when executing scripts, which could result in local privilege escalation.

For the oldstable distribution (lenny), this problem has been fixed in version 1.0.8-1lenny4.

For the stable distribution (squeeze), this problem has been fixed in version 1:2.0.7-1squeeze3.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your acpid packages.

Original Source

Url : http://www.debian.org/security/2011/dsa-2362

CWE : Common Weakness Enumeration

% Id Name
67 % CWE-264 Permissions, Privileges, and Access Controls
33 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:15149
 
Oval ID: oval:org.mitre.oval:def:15149
Title: DSA-2362-1 acpid -- several
Description: Multiple vulnerabilities were found in the acpid, the Advanced Configuration and Power Interface event daemon: CVE-2011-1159 Vasiliy Kulikov of OpenWall discovered that the socket handling is vulnerable to denial of service. CVE-2011-2777 Oliver-Tobias Ripka discovered that incorrect process handling in the Debian-specific powerbtn.sh script could lead to local privilege escalation. This issue doesn't affect oldstable. The script is only shipped as an example in /usr/share/doc/acpid/examples. See /usr/share/doc/acpid/README.Debian for details. CVE-2011-4578 Helmut Grohne and Michael Biebl discovered that acpid sets a umask of 0 when executing scripts, which could result in local privilege escalation.
Family: unix Class: patch
Reference(s): DSA-2362-1
CVE-2011-1159
CVE-2011-2777
CVE-2011-4578
 Version: 5
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): acpid
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:15207
 
Oval ID: oval:org.mitre.oval:def:15207
Title: USN-1296-1 -- acpid vulnerabilities
Description: acpid: Advanced Configuration and Power Interface daemon Several security issues were fixed in acpid.
Family: unix Class: patch
Reference(s): USN-1296-1
CVE-2011-2777
CVE-2011-4578
 Version: 5
Platform(s): Ubuntu 11.04
Ubuntu 11.10
Ubuntu 10.04
Ubuntu 10.10
 Product(s): acpid
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21324
 
Oval ID: oval:org.mitre.oval:def:21324
Title: USN-1234-1 -- acpid vulnerability
Description: acpid could be made to stall under certain conditions.
Family: unix Class: patch
Reference(s): USN-1234-1
CVE-2011-1159
 Version: 5
Platform(s): Ubuntu 11.04
Ubuntu 10.10
Ubuntu 10.04
 Product(s): acpid
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 10
Application 16

ExploitDB Exploits

id Description
2011-12-10 Acpid 1:2.0.10-1ubuntu2 Privilege Boundary Crossing Vulnerability

OpenVAS Exploits

Date Description
2012-08-21 Name : Mandriva Update for acpid MDVSA-2012:137 (acpid)
File : nvt/gb_mandriva_MDVSA_2012_137.nasl
2012-08-03 Name : Mandriva Update for acpid MDVSA-2012:086 (acpid)
File : nvt/gb_mandriva_MDVSA_2012_086.nasl
2012-02-11 Name : Debian Security Advisory DSA 2362-1 (acpid)
File : nvt/deb_2362_1.nasl
2011-12-09 Name : Ubuntu Update for acpid USN-1296-1
File : nvt/gb_ubuntu_USN_1296_1.nasl
2011-10-21 Name : Ubuntu Update for acpid USN-1234-1
File : nvt/gb_ubuntu_USN_1234_1.nasl
2011-05-17 Name : Fedora Update for acpid FEDORA-2011-6460
File : nvt/gb_fedora_2011_6460_acpid_fc14.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
77592 acpid /etc/acpi/powerbtn.sh Process ID Identification DBUS_SESSION_BUS_ADDRES...
77557 acpid Event Scripts Insecure umask Local Information Disclosure
70625 acpid Daemon Socket Blocking Mode Local DoS

acpid contains a flaw that may allow a local denial of service. The issue is triggered when the daemon uses a socket in blocking mode to communicate with unprivileged programs, which may be exploited to cause a denial of service.

Nessus® Vulnerability Scanner

Date Description
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-55.nasl - Type : ACT_GATHER_INFO
2013-10-29 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201310-20.nasl - Type : ACT_GATHER_INFO
2012-09-06 Name : The remote Mandriva Linux host is missing a security update.
File : mandriva_MDVSA-2012-137.nasl - Type : ACT_GATHER_INFO
2012-06-01 Name : The remote Mandriva Linux host is missing a security update.
File : mandriva_MDVSA-2012-086.nasl - Type : ACT_GATHER_INFO
2012-01-12 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2362.nasl - Type : ACT_GATHER_INFO
2011-12-09 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1296-1.nasl - Type : ACT_GATHER_INFO
2011-10-21 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1234-1.nasl - Type : ACT_GATHER_INFO
2011-05-16 Name : The remote Fedora host is missing a security update.
File : fedora_2011-6460.nasl - Type : ACT_GATHER_INFO
2011-05-10 Name : The remote Fedora host is missing a security update.
File : fedora_2011-6681.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:30:38
  • Multiple Updates