Red Hat acpid '/var/log/acpid' Log File Permissions Local Privilege Escalation Vulnerability

Bugtraq ID:	37249
Class:	Design Error
CVE:	CVE-2009-4033
Remote:	No
Local:	Yes
Published:	Dec 07 2009 12:00AM
Updated:	Dec 28 2009 06:02AM
Credit:	David Tonhofer
Vulnerable:	Redhat Enterprise Linux Virtualization 5 Server Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0
Not Vulnerable:

Red Hat acpid '/var/log/acpid' Log File Permissions Local Privilege Escalation Vulnerability

Red Hat Enterprise Linux is prone to a local privilege-escalation vulnerability.

A local attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges, resulting in a complete compromise of the affected computer,

This issue affects the 'acpid' application distributed with Red Hat Enterprise Linux 5.

Red Hat acpid '/var/log/acpid' Log File Permissions Local Privilege Escalation Vulnerability

An attacker can use readily available utilities to exploit this issue.

Red Hat acpid '/var/log/acpid' Log File Permissions Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for details.


MandrakeSoft Corporate Server 4.0

• Mandriva acpid-1.0.4-6.4.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/

Red Hat acpid '/var/log/acpid' Log File Permissions Local Privilege Escalation Vulnerability

References:

• Bug 542926 �?? CVE-2009-4033 acpid: log file created with random permissions (Tomas Hoger)
  
• Red Hat Homepage (Red Hat)