event.c in acpid (aka acpid2) before 2.0.11 does not have an appropriate umask setting during execution of event-handler scripts, which might allow local users to (1) perform write operations within directories created by a script, or (2) read files created by a script, via standard filesystem system calls.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - acpid: blocked writes can lead to acpid daemon hang (CVE-2011-1159)

  - acpid: Unsafe umask for actions executed by acpid (CVE-2011-4578)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - acpid: blocked writes can lead to acpid daemon hang (CVE-2011-1159)

  - acpid: Unsafe umask for actions executed by acpid (CVE-2011-4578)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - acpid: blocked writes can lead to acpid daemon hang (CVE-2011-1159)

  - acpid: Unsafe umask for actions executed by acpid (CVE-2011-4578)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Multiple vulnerabilities has been discovered and corrected in acpid :

Oliver-Tobias Ripka discovered that an ACPI script incorrectly handled power button events. A local attacker could use this to execute arbitrary code, and possibly escalate privileges (CVE-2011-2777).

Helmut Grohne and Michael Biebl discovered that ACPI scripts were executed with a permissive file mode creation mask (umask). A local attacker could read files and modify directories created by ACPI scripts that did not set a strict umask (CVE-2011-4578).

The updated packages have been patched to correct these issues.

Multiple vulnerabilities were found in the ACPI Daemon, the Advanced Configuration and Power Interface event daemon :

  - CVE-2011-1159     Vasiliy Kulikov of OpenWall discovered that the socket     handling is vulnerable to denial of service.

  - CVE-2011-2777     Oliver-Tobias Ripka discovered that incorrect process     handling in the Debian-specific powerbtn.sh script could     lead to local privilege escalation. This issue doesn't     affect oldstable. The script is only shipped as an     example in /usr/share/doc/acpid/examples. See     /usr/share/doc/acpid/README.Debian for details.

  - CVE-2011-4578     Helmut Grohne and Michael Biebl discovered that acpid     sets a umask of 0 when executing scripts, which could     result in local privilege escalation.

Oliver-Tobias Ripka discovered that an ACPI script incorrectly handled power button events. A local attacker could use this to execute arbitrary code, and possibly escalate privileges. (CVE-2011-2777)

Helmut Grohne and Michael Biebl discovered that ACPI scripts were executed with a permissive file mode creation mask (umask). A local attacker could read files and modify directories created by ACPI scripts that did not set a strict umask. (CVE-2011-4578).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199330	RHEL 6 : acpid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199324	RHEL 4 : acpid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199291	RHEL 5 : acpid (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
74737	openSUSE Security Update : acpid (openSUSE-2012-55)	Nessus	SuSE Local Security Checks	medium
61983	Mandriva Linux Security Advisory : acpid (MDVSA-2012:137)	Nessus	Mandriva Local Security Checks	medium
57502	Debian DSA-2362-1 : acpid - several vulnerabilities	Nessus	Debian Local Security Checks	medium
57060	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : acpid vulnerabilities (USN-1296-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2011-4578

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium