- ------------------------------------------------------------------------- Debian Security Advisory DSA-2376-2 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Thijs Kinkhorst December 31, 2011 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : ipmitool Vulnerability : insecure pid file Problem type : local Debian-specific: no CVE ID : CVE-2011-4339 Debian Bug : 651917 It was discovered that OpenIPMI, the Intelligent Platform Management Interface library and tools, used too wide permissions PID file, which allows local users to kill arbitrary processes by writing to this file. The original announcement didn't contain corrections for the Debian 5.0 "lenny" distribution. This update adds packages for lenny. For the oldstable distribution (lenny), this problem has been fixed in version 1.8.9-2+squeeze1. (Although the version number contains the string "squeeze", this is in fact an update for lenny.) For the stable distribution (squeeze), this problem has been fixed in version 1.8.11-2+squeeze2. For the unstable distribution (sid), this problem has been fixed in version 1.8.11-5. We recommend that you upgrade your ipmitool packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
Debian: DSA-2376-2: ipmitool security update
It was discovered that OpenIPMI, the Intelligent Platform Management Interface library and tools, used too wide permissions PID file, which allows local users to kill arbitrary processes by writing to this file.
