PT-2011-1037 · Acpid · Acpid

Published 2011-10-05 · Updated 2013-04-05 · CVE-2011-4578

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions acpid versions prior to 2.0.11

Description The issue allows local users to potentially perform unauthorized write operations within directories created by a script or read files created by a script due to insufficient umask settings in event-handler scripts. This could lead to a breach of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out by a local attacker.

Recommendations For versions prior to 2.0.11, update to version 2.0.11 or later to resolve the issue. As a temporary workaround, consider setting an appropriate umask manually before executing event-handler scripts to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-264

Related Identifiers

BDU:2015-02177

CVE-2011-4578

DSA-2362-1

Affected Products

Acpid

References · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4578 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2777 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-4578 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:138 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-4578 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1159 · Security Note
• https://osv.dev/vulnerability/CVE-2011-4578 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02177 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4578 · Security Note
• http://debian.org/security/dsa-2362 · Note
• https://bugs.launchpad.net/ubuntu/+source/acpid/+bug/893821 · Note
• http://sourceforge.net/u/tedfelix/acpid2/ci/02d0bf29207f17996936ab652717855b15873901/tree/Changelog?force=True · Note
• http://openwall.com/lists/oss-security/2011/12/06/3 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=760984 · Note