samples/powerbtn/powerbtn.sh in acpid (aka acpid2) 2.0.16 and earlier uses the pidof program incorrectly, which allows local users to gain privileges by running a program with the name kded4 and a DBUS_SESSION_BUS_ADDRESS environment variable containing commands.

The remote host is affected by the vulnerability described in GLSA-201310-20 (acpid2: Privilege escalation)

    acpid2 does not properly use the pidof program in powerbtn.sh.
  Impact :

    A local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been discovered and corrected in acpid :

Oliver-Tobias Ripka discovered that an ACPI script incorrectly handled power button events. A local attacker could use this to execute arbitrary code, and possibly escalate privileges (CVE-2011-2777).

Helmut Grohne and Michael Biebl discovered that ACPI scripts were executed with a permissive file mode creation mask (umask). A local attacker could read files and modify directories created by ACPI scripts that did not set a strict umask (CVE-2011-4578).

The updated packages have been patched to correct these issues.

Multiple vulnerabilities were found in the ACPI Daemon, the Advanced Configuration and Power Interface event daemon :

  - CVE-2011-1159     Vasiliy Kulikov of OpenWall discovered that the socket     handling is vulnerable to denial of service.

  - CVE-2011-2777     Oliver-Tobias Ripka discovered that incorrect process     handling in the Debian-specific powerbtn.sh script could     lead to local privilege escalation. This issue doesn't     affect oldstable. The script is only shipped as an     example in /usr/share/doc/acpid/examples. See     /usr/share/doc/acpid/README.Debian for details.

  - CVE-2011-4578     Helmut Grohne and Michael Biebl discovered that acpid     sets a umask of 0 when executing scripts, which could     result in local privilege escalation.

Oliver-Tobias Ripka discovered that an ACPI script incorrectly handled power button events. A local attacker could use this to execute arbitrary code, and possibly escalate privileges. (CVE-2011-2777)

Helmut Grohne and Michael Biebl discovered that ACPI scripts were executed with a permissive file mode creation mask (umask). A local attacker could read files and modify directories created by ACPI scripts that did not set a strict umask. (CVE-2011-4578).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
70676	GLSA-201310-20 : acpid2: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
61983	Mandriva Linux Security Advisory : acpid (MDVSA-2012:137)	Nessus	Mandriva Local Security Checks	medium
57502	Debian DSA-2362-1 : acpid - several vulnerabilities	Nessus	Debian Local Security Checks	medium
57060	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : acpid vulnerabilities (USN-1296-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-2777

high

Tenable Plugins

medium

medium

medium

medium