Bug 434522 – <sys-power/acpid-2.0.17 : Local privilege escalation (CVE-2011-2777)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2012-09-09 23:26:06 UTC]

CVE-2011-2777 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2777):
  samples/powerbtn/powerbtn.sh in acpid (aka acpid2) 2.0.16 and earlier uses
  the pidof program incorrectly, which allows local users to gain privileges
  by running a program with the name kded4 and a DBUS_SESSION_BUS_ADDRESS
  environment variable containing commands.


References (with patch):
https://bugs.launchpad.net/ubuntu/+source/acpid/+bug/893821

[Comment 1 Pacho Ramos 2012-11-18 13:21:45 UTC]

Let's stabilize 2.0.17 then

[Comment 2 Agostino Sarubbo 2012-11-18 13:29:31 UTC]

amd64 stable

[Comment 3 Agostino Sarubbo 2012-11-18 13:29:57 UTC]

x86 stable

[Comment 4 Sean Amoss (RETIRED) 2012-11-18 14:35:22 UTC]

Thanks, everyone. GLSA request filed. IA64 should continue with stabilization, but not needed for GLSA.

[Comment 5 Raúl Porcel (RETIRED) 2012-11-25 18:58:53 UTC]

ia64 stable

[Comment 6 Michal Hrusecky (RETIRED) 2013-01-03 13:40:10 UTC]

Ok, so 2.0.17 is stable for all architectures 2.0.16 was stable before and 2.0.16 was removed from the tree, is there still anything left or can we close this one?

[Comment 7 Pacho Ramos 2013-01-03 15:53:41 UTC]

I think once you drop vulnerable versions, that is all from maintainer part and you can unCC, while keeping bug opened to let security team fill glsa and that things

[Comment 8 Michal Hrusecky (RETIRED) 2013-01-03 15:57:52 UTC]

Ok, so vulnerable version dropped, everything ready for security guys :-) Thanks.

[Comment 9 GLSAMaker/CVETool Bot 2013-10-28 17:07:49 UTC]

This issue was resolved and addressed in
 GLSA 201310-20 at http://security.gentoo.org/glsa/glsa-201310-20.xml
by GLSA coordinator Sergey Popov (pinkbyte).