CVE-2009-4033 A certain Red Hat patch for acpid 1.0.4 effectively triggers a call to the open function with insufficient arguments, which might allow local users to leverage weak permissions on /var/log/acpid, and....
MediumCVSS 6.9
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A certain Red Hat patch for acpid 1.0.4 effectively triggers a call to the open function with insufficient arguments, which might allow local users to leverage weak permissions on /var/log/acpid, and obtain sensitive information by reading this file, cause a denial of service by overwriting this file, or gain privileges by executing this file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tim hockin acpid | = 1.0.4 | No fix listed |
References
- 1023284 vdb-entry
- MDVSA-2009:342 vendor-advisory
- RHSA-2009:1642 vendor-advisory
- 37249 vdb-entry
- bugzilla.redhat.com
- bugzilla.redhat.com
- acpid-logfile-privilege-escalation(54677) vdb-entry
- oval:org.mitre.oval:def:10555 signature vdb-entry
- Debian Security Tracker CVE-2009-4033 vendor-advisory