CVE-2011-2777

2012-08-2922:55:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2011-2777

acpid

acpid2

privilege escalation

security vulnerability

nvd

6.2 Medium

AI Score

Confidence

Low

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

12.3%

JSON

samples/powerbtn/powerbtn.sh in acpid (aka acpid2) 2.0.16 and earlier uses the pidof program incorrectly, which allows local users to gain privileges by running a program with the name kded4 and a DBUS_SESSION_BUS_ADDRESS environment variable containing commands.

CPENameOperatorVersion
tedfelix:acpid2tedfelix acpid2eq2.0.13
tedfelix:acpid2tedfelix acpid2eq2.0.11
tedfelix:acpid2tedfelix acpid2eq2.0.6
tedfelix:acpid2tedfelix acpid2eq2.0.2
tedfelix:acpid2tedfelix acpid2eq2.0.4
tedfelix:acpid2tedfelix acpid2eq2.0.5
tedfelix:acpid2tedfelix acpid2eq2.0.1
tedfelix:acpid2tedfelix acpid2eq2.0.9
tedfelix:acpid2tedfelix acpid2eq2.0.14
tedfelix:acpid2tedfelix acpid2le2.0.16

CPE	Name	Operator	Version
tedfelix:acpid2	tedfelix acpid2	eq	2.0.13
tedfelix:acpid2	tedfelix acpid2	eq	2.0.11
tedfelix:acpid2	tedfelix acpid2	eq	2.0.6
tedfelix:acpid2	tedfelix acpid2	eq	2.0.2
tedfelix:acpid2	tedfelix acpid2	eq	2.0.4
tedfelix:acpid2	tedfelix acpid2	eq	2.0.5
tedfelix:acpid2	tedfelix acpid2	eq	2.0.1
tedfelix:acpid2	tedfelix acpid2	eq	2.0.9
tedfelix:acpid2	tedfelix acpid2	eq	2.0.14
tedfelix:acpid2	tedfelix acpid2	le	2.0.16