ACPI Event Daemon (acpid) before 1.0.10 allows remote attackers to cause a denial of service (CPU consumption and connectivity loss) by opening a large number of UNIX sockets without closing them, which triggers an infinite loop.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities in several third-party components and libraries :

  - A denial of service vulnerability exists in the ACPI     Event Daemon (acpid) that allows a remote attacker to     cause a consumption of CPU resources by opening a large     number of UNIX sockets without closing them.
    (CVE-2009-0798)

  - A security bypass vulnerability exists in Samba in the     acl_group_override() function when dos filemode is     enabled. A remote attacker can exploit this to modify     access control lists for files via vectors related to     read access to uninitialized memory. (CVE-2009-1888)

  - A security bypass vulnerability exists in Samba in the     SMB subsystem due to improper handling of errors when     resolving pathnames. An authenticated, remote attacker     can exploit this to bypass intended sharing     restrictions, and read, create, or modify files, in     certain circumstances involving user accounts that lack     home directories. (CVE-2009-2813)

  - A denial of service vulnerability exists in Samba that     allows authenticated, remote attackers to cause an     infinite loop via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

  - An information disclosure vulnerability exists in Samba     in mount.cifs due to improper enforcement of     permissions. A local attacker can exploit this to read     part of the credentials file and obtain the password by     specifying the path to the credentials file and using     the --verbose or -v option. (CVE-2009-2948)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Resolves: #515062 CVE-2009-4033 acpid: log file created     with random permissions

  - start acpid before hal

  - Resolves: #503177

  - Updated the License entry

  - Fixed CVE-2009-0798 (too many open files DoS)

  - Resolves: #496292

The remote OracleVM system is missing necessary patches to address critical security updates :

CVE-2009-0798 

The daemon in acpid before 1.0.10 allows remote attackers to cause a denial of service (CPU consumption and connectivity loss) by opening a large number of UNIX sockets without closing them, which triggers an infinite loop.

  - Updated the License entry

  - Fixed CVE-2009-0798 (too many open files DoS)

  - Resolves: #496291

  - Minor fixes in init script

  - Resolves: #237752

  - Review of init script

  - Fixed fd leaking

  - Resolves: #237752 #441686

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2009-0474 advisory.

    - Fixed CVE-2009-0798 (too many open files DoS)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Anthony de Almeida Lopes of Outpost24 AB reported a denial of service flaw in the acpid daemon's error handling. If an attacker could exhaust the sockets open to acpid, the daemon would enter an infinite loop, consuming most CPU resources and preventing acpid from communicating with legitimate processes. (CVE-2009-0798)

a. Service Console update for samba to 3.0.33-3.15.el5_4.1

   This update changes the samba packages to    samba-client-3.0.33-3.15.el5_4.1 and    samba-common-3.0.33-3.15.el5_4.1. These versions include fixes for    security issues that were first fixed in    samba-client-3.0.33-0.18.el4_8 and samba-common-3.0.33-0.18.el4_8.
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2009-2906, CVE-2009-1888,CVE-2009-2813    and CVE-2009-2948 to these issues.

b. Service Console update for acpid to1.0.4-9.el5_4.2

   This updates changes the the acpid package to acpid-1.0.4-9.el5_4.2.
   This version includes the fix for a security issue that was first    fixed in acpid-1.0.4-7.el5_4.1.  

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0798 to this issue.

Fixed CVE-2009-0798 (too many open files DoS)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated acpid package that fixes one security issue is now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

acpid is a daemon that dispatches ACPI (Advanced Configuration and Power Interface) events to user-space programs.

Anthony de Almeida Lopes of Outpost24 AB reported a denial of service flaw in the acpid daemon's error handling. If an attacker could exhaust the sockets open to acpid, the daemon would enter an infinite loop, consuming most CPU resources and preventing acpid from communicating with legitimate processes. (CVE-2009-0798)

Users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200905-06 (acpid: Denial of Service)

    The acpid daemon allows opening a large number of UNIX sockets without     closing them, triggering an infinite loop.
  Impact :

    Remote attackers can cause a Denial of Service (CPU consumption and     connectivity loss).
  Workaround :

    There is no known workaround at this time.

The daemon in acpid before 1.0.10 allows remote attackers to cause a denial of service (CPU consumption and connectivity loss) by opening a large number of UNIX sockets without closing them, which triggers an infinite loop (CVE-2009-0798).

The updated packages have been patched to prevent this.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

It was discovered that acpid, a daemon for delivering ACPI events, is prone to a denial of service attack by opening a large number of UNIX sockets, which are not closed properly.

It was discovered that acpid did not properly handle a large number of connections. A local user could exploit this and monopolize CPU resources, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
89738	VMware ESX Third-Party Libraries and Components Multiple Vulnerabilities (VMSA-2010-0006) (remote check)	Nessus	VMware ESX Local Security Checks	medium
79472	OracleVM 2.2 : acpid (OVMSA-2009-0037)	Nessus	OracleVM Local Security Checks	medium
79455	OracleVM 2.1 : acpid (OVMSA-2009-0008)	Nessus	OracleVM Local Security Checks	medium
67855	Oracle Linux 5 : acpid (ELSA-2009-0474)	Nessus	Oracle Linux Local Security Checks	high
60580	Scientific Linux Security Update : acpid on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
45402	VMSA-2010-0006 : ESX Service Console updates for samba and acpid	Nessus	VMware ESX Local Security Checks	medium
38942	Fedora 9 : acpid-1.0.6-8.fc9 (2009-5608)	Nessus	Fedora Local Security Checks	medium
38941	Fedora 10 : acpid-1.0.6-11.fc10 (2009-5578)	Nessus	Fedora Local Security Checks	medium
38903	CentOS 3 / 4 / 5 : acpid (CESA-2009:0474)	Nessus	CentOS Local Security Checks	medium
38887	GLSA-200905-06 : acpid: Denial of Service	Nessus	Gentoo Local Security Checks	medium
38710	RHEL 3 / 4 / 5 : acpid (RHSA-2009:0474)	Nessus	Red Hat Local Security Checks	medium
38707	Mandriva Linux Security Advisory : acpid (MDVSA-2009:107-1)	Nessus	Mandriva Local Security Checks	medium
38667	Debian DSA-1786-1 : acpid - denial of service	Nessus	Debian Local Security Checks	medium
38195	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : acpid vulnerability (USN-766-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2009-0798

high

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium