Bug 393487 – <sys-power/acpid-2.0.11 unrespected umask for scripts run by acpid (CVE-2011-4578)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2011-12-07 09:09:24 UTC]

From oss-security mailing list at $URL:


------
* Sat Jul 30 2011  Ted Felix <http://www.tedfelix.com>
  - 2.0.11 release
  - Set umask to 0077 for scripts run by acpid.  (event.c)  (Ted Felix)
------

Discovered by Helmut Grohne and Michael Biebl.


Already fix in tree, just to track CVE.

[Comment 1 Agostino Sarubbo 2011-12-07 15:03:59 UTC]

Secunia advisory reference:

https://secunia.com/advisories/47071/

[Comment 2 Tim Sammut (RETIRED) 2011-12-07 16:52:57 UTC]

Thanks, Agostino. GLSA Vote: no.

[Comment 3 Sean Amoss (RETIRED) 2012-03-06 21:19:26 UTC]

Vote: no.

Closing noglsa.

[Comment 4 GLSAMaker/CVETool Bot 2012-09-08 15:28:12 UTC]

CVE-2011-4578 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4578):
  event.c in acpid (aka acpid2) before 2.0.11 does not have an appropriate
  umask setting during execution of event-handler scripts, which might allow
  local users to (1) perform write operations within directories created by a
  script, or (2) read files created by a script, via standard filesystem
  system calls.