event.c in acpid (aka acpid2) before 2.0.11 does not have an appropriate umask setting during execution of event-handler scripts, which might allow local users to (1) perform write operations within directories created by a script, or (2) read files created by a script, via standard filesystem system calls.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - event.c in acpid (aka acpid2) before 2.0.11 does not have an appropriate umask setting during execution of     event-handler scripts, which might allow local users to (1) perform write operations within directories     created by a script, or (2) read files created by a script, via standard filesystem system calls.
    (CVE-2011-4578)

Note that Nessus relies on the presence of the package as reported by the vendor.

Multiple vulnerabilities has been discovered and corrected in acpid :

Oliver-Tobias Ripka discovered that an ACPI script incorrectly handled power button events. A local attacker could use this to execute arbitrary code, and possibly escalate privileges (CVE-2011-2777).

Helmut Grohne and Michael Biebl discovered that ACPI scripts were executed with a permissive file mode creation mask (umask). A local attacker could read files and modify directories created by ACPI scripts that did not set a strict umask (CVE-2011-4578).

The updated packages have been patched to correct these issues.

Multiple vulnerabilities were found in the ACPI Daemon, the Advanced Configuration and Power Interface event daemon :

  - CVE-2011-1159     Vasiliy Kulikov of OpenWall discovered that the socket     handling is vulnerable to denial of service.

  - CVE-2011-2777     Oliver-Tobias Ripka discovered that incorrect process     handling in the Debian-specific powerbtn.sh script could     lead to local privilege escalation. This issue doesn't     affect oldstable. The script is only shipped as an     example in /usr/share/doc/acpid/examples. See     /usr/share/doc/acpid/README.Debian for details.

  - CVE-2011-4578     Helmut Grohne and Michael Biebl discovered that acpid     sets a umask of 0 when executing scripts, which could     result in local privilege escalation.

Oliver-Tobias Ripka discovered that an ACPI script incorrectly handled power button events. A local attacker could use this to execute arbitrary code, and possibly escalate privileges. (CVE-2011-2777)

Helmut Grohne and Michael Biebl discovered that ACPI scripts were executed with a permissive file mode creation mask (umask). A local attacker could read files and modify directories created by ACPI scripts that did not set a strict umask. (CVE-2011-4578).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
217534	Linux Distros Unpatched Vulnerability : CVE-2011-4578	Nessus	Misc.	high
74737	openSUSE Security Update : acpid (openSUSE-2012-55)	Nessus	SuSE Local Security Checks	medium
61983	Mandriva Linux Security Advisory : acpid (MDVSA-2012:137)	Nessus	Mandriva Local Security Checks	medium
57502	Debian DSA-2362-1 : acpid - several vulnerabilities	Nessus	Debian Local Security Checks	medium
57060	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : acpid vulnerabilities (USN-1296-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-4578

high

Tenable Plugins

high

medium

medium

medium

medium