Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Gentoo GLSA-201310-20 High: acpid2 Privilege Escalation Risk

gentoo
Calendar Grey October 28, 2013
Dist Gentoo Esm H88
Important Gentoo GLSA: Local threat can gain higher privileges through acpid2. Update advised for protection.
A vulnerability in acpid2 may allow a local attacker to gain escalated privileges.

Summary

acpid2 does not properly use the pidof program in powerbtn.sh.

Topics%20covered

Topics Covered

security advisory high severity gentoo privilege escalation acpid2

Resolution

All acpid2 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-power/acpid-2.0.17"

References

[ 1 ] CVE-2011-2777 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2777

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201310-20
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: High
Title: acpid2: Privilege escalation
Date: October 28, 2013
Bugs: #434522
ID: 201310-20

Topics%20covered

Topics Covered

security advisory high severity gentoo privilege escalation acpid2

Synopsis

A vulnerability in acpid2 may allow a local attacker to gain escalated privileges.

Background

acpid2 is a daemon for Advanced Configuration and Power Interface.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-power/acpid < 2.0.17 >= 2.0.17

Impact

===== A local attacker could gain escalated privileges.

Workaround

There is no known workaround at this time.

Related News

Your message here