PT-2009-1059 · Acpid+1 · Acpid+1
Tomas Hoger
·
Published
2009-12-07
·
Updated
2017-09-19
·
CVE-2009-4033
CVSS v2.0
6.9
Medium
| Vector | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
acpid version 1.0.4
Description
The issue allows local users to potentially obtain sensitive information by reading the /var/log/acpid file, cause a denial of service by overwriting this file, or gain privileges by executing this file, due to weak permissions on /var/log/acpid. This could lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out locally.
Recommendations
For acpid version 1.0.4, consider restricting access to the /var/log/acpid file to minimize the risk of exploitation. As a temporary workaround, ensure that the permissions on /var/log/acpid are set to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Red Hat
Acpid