Local File Access Vulnerability in acpid Package
Summary
DEBIAN-CVE-2011-4578: event.c in acpid (aka acpid2) before 2.0.11 does not have an appropriate umask setting during execution of event-handler scripts, which might allow local users to (1) perform write operations within directories created b... Affects acpid versions < 1:2.0.11-1. Fixed in 1:2.0.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The acpid package is a daemon that listens for Advanced Configuration and Power Interface (ACPI) events and executes scripts based on those events. It is commonly used in Linux systems to manage power-related tasks and respond to hardware events. The package is designed to enhance system responsiveness to hardware changes, but it has been found to have a vulnerability that could allow local users to manipulate file permissions improperly.
Vulnerability Detail
The vulnerability identified as CVE-2011-4578 exists in event.c of the acpid package prior to version 2.0.11. It lacks an appropriate umask setting during the execution of event-handler scripts. This oversight could permit local users to perform unauthorized write operations within directories created by these scripts or read files generated by them. The implications of this vulnerability are significant, as it could lead to unauthorized access to sensitive information or manipulation of system configurations.
How To Fix
Minimum fixed version
1:2.0.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade acpidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually adjust the permissions of the directories and files created by acpid scripts to restrict access. This can be done using the chmod command, for example: 'chmod 700 /path/to/directory' to limit access to the owner only.
Conclusion
The acpid package has a critical vulnerability (CVE-2011-4578) that can lead to unauthorized file access by local users. It is essential to update to the patched version to mitigate these risks. Users should also consider temporary workarounds while preparing for the update.
See every vulnerability recorded for acpid →
FAQ
CVE-2011-4578 is a vulnerability in the acpid package that allows local users to access or modify files improperly due to inadequate umask settings.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
The risks include unauthorized access to sensitive files and the potential for local users to manipulate system configurations, which could compromise system integrity.
Yes, a patch is available in version 1:2.0.11-1 of the acpid package. Users should update to this version or later.
If an immediate update is not possible, consider implementing the workaround by adjusting file permissions to limit access until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for acpid.
