acpid.c in acpid before 2.0.9 does not properly handle a situation in which a process has connected to acpid.socket but is not reading any data, which allows local users to cause a denial of service (daemon hang) via a crafted application that performs a connect system call but no read system calls.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - acpid: blocked writes can lead to acpid daemon hang (CVE-2011-1159)

  - acpid: Unsafe umask for actions executed by acpid (CVE-2011-4578)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - acpid: blocked writes can lead to acpid daemon hang (CVE-2011-1159)

  - acpid: Unsafe umask for actions executed by acpid (CVE-2011-4578)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - acpid: blocked writes can lead to acpid daemon hang (CVE-2011-1159)

  - acpid: Unsafe umask for actions executed by acpid (CVE-2011-4578)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

A vulnerability has been discovered and corrected in acpid :

acpid.c in acpid before 2.0.9 does not properly handle a situation in which a process has connected to acpid.socket but is not reading any data, which allows local users to cause a denial of service (daemon hang) via a crafted application that performs a connect system call but no read system calls (CVE-2011-1159).

The updated packages have been patched to correct this issue.

Multiple vulnerabilities were found in the ACPI Daemon, the Advanced Configuration and Power Interface event daemon :

  - CVE-2011-1159     Vasiliy Kulikov of OpenWall discovered that the socket     handling is vulnerable to denial of service.

  - CVE-2011-2777     Oliver-Tobias Ripka discovered that incorrect process     handling in the Debian-specific powerbtn.sh script could     lead to local privilege escalation. This issue doesn't     affect oldstable. The script is only shipped as an     example in /usr/share/doc/acpid/examples. See     /usr/share/doc/acpid/README.Debian for details.

  - CVE-2011-4578     Helmut Grohne and Michael Biebl discovered that acpid     sets a umask of 0 when executing scripts, which could     result in local privilege escalation.

Vasiliy Kulikov discovered that acpid did not properly handle connections from poorly behaving clients. A local attacker could potentially exploit this to cause a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue May 3 2011 Jiri Skala <jskala at redhat.com> -     2.0.9-1

    - fixes #701340 - CVE-2011-1159 acpid: blocked writes       can lead to acpid daemon hang

    - update to latest upstream 2.0.9

    - Wed Dec 8 2010 Jiri Skala <jskala at redhat.com> -       2.0.7-1

    - fixes #660459 - Should be able to set options with       /etc/sysconfig/acpid

    - update to latest upstream

    - Wed Nov 3 2010 Jiri Skala <jskala at redhat.com> -       2.0.5-4

    - fixes #648221 - SELinux is preventing /sbin/iwconfig       access to a leaked /dev/input/event0 file descriptor

    - Wed Sep 29 2010 jkeating - 2.0.5-3.1

    - Rebuilt for gcc bug 634757

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes acpid to properly handle SysVinit -> systemd upgrades.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199330	RHEL 6 : acpid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199324	RHEL 4 : acpid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199291	RHEL 5 : acpid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
59319	Mandriva Linux Security Advisory : acpid (MDVSA-2012:086)	Nessus	Mandriva Local Security Checks	low
57502	Debian DSA-2362-1 : acpid - several vulnerabilities	Nessus	Debian Local Security Checks	medium
56581	Ubuntu 10.04 LTS / 10.10 / 11.04 : acpid vulnerability (USN-1234-1)	Nessus	Ubuntu Local Security Checks	low
53902	Fedora 14 : acpid-2.0.9-1.fc14 (2011-6460)	Nessus	Fedora Local Security Checks	low
53851	Fedora 15 : acpid-2.0.9-4.fc15 (2011-6681)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2011-1159

medium

Tenable Plugins

medium

medium

medium

low

medium

low

low

low