DSA-3020-1: acpi-support - security update
Summary
DSA-3020-1: acpi-support - security update. Affects acpi-support versions < 0.140-5+deb7u3. Fixed in 0.140-5+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
acpi-support is a package in the Debian ecosystem, specifically for Debian 7. It provides scripts and tools for handling ACPI events on Debian systems. ACPI (Advanced Configuration and Power Interface) is an industry standard for power management and configuration of computers. The acpi-support package is responsible for managing ACPI events and performing actions based on those events. This package is vulnerable to a security issue.
Vulnerability Detail
The vulnerability, identified as CVE-2014-0484, affects the acpi-support package in Debian 7. It allows local attackers to execute arbitrary commands as root by leveraging improper handling of filenames with shell metacharacters in the acpi-support-0.140-5+deb7u2 package. This vulnerability can be exploited by an attacker with local access to the system, potentially leading to unauthorized access, privilege escalation, or other malicious activities.
How To Fix
Minimum fixed version
0.140-5+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade acpi-supportTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted users have local access to the system and by implementing strong access controls and monitoring mechanisms.
Conclusion
The acpi-support package in Debian 7 is vulnerable to a security issue that allows local attackers to execute arbitrary commands as root. To mitigate this vulnerability, users should update their acpi-support package to version 0.140-5+deb7u3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for acpi-support →
FAQ
acpi-support is a package in the Debian ecosystem that provides scripts and tools for handling ACPI events on Debian systems.
ACPI (Advanced Configuration and Power Interface) is an industry standard for power management and configuration of computers.
The vulnerability allows local attackers to execute arbitrary commands as root, potentially leading to unauthorized access, privilege escalation, or other malicious activities.
To fix this vulnerability, users should update their acpi-support package to version 0.140-5+deb7u3 or later using the package manager.
While no specific workaround is mentioned, users can mitigate the risk by implementing strong access controls and monitoring mechanisms.
Related vulnerabilities
Recent vulnerabilities recorded for acpi-support.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
