CVE-2011-4339 — Incorrect Permission Assignment in Ipmitool

CWE-732 — Incorrect Permission Assignment7 documents6 sources
Severity
3.6LOWNVD
EPSS
0.1%
top 80.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Ipmitool Project IpmitoolDebian Ipmitool
Timeline
PublishedDec 15
Latest updateMay 13

Description

ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this file.

CVSS vector

AV:L/AC:L/C:N/I:P/A:PExploitability: 3.9 | Impact: 4.9

Affected Packages3 packages

▶debiandebian/ipmitool< ipmitool 1.8.11-5 (bookworm)
▶Debianipmitool_project/ipmitool< 1.8.11-5+3

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-g5hf-fh87-v7gq: ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1↗2022-05-13
▶
OSV
CVE-2011-4339: ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1↗2011-12-15
▶

📋Vendor Advisories

2
Red Hat
OpenIPMI: IPMI event daemon creates PID file with world writeable permissions↗2011-12-13
▶
Debian
CVE-2011-4339: ipmitool - ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package...↗2011
▶

💬Community

2
Bugzilla
CVE-2011-4339 OpenIPMI: IPMI event daemon creates PID file with world writeable permissions [fedora-all]↗2011-12-13
▶
Bugzilla
CVE-2011-4339 OpenIPMI: IPMI event daemon creates PID file with world writeable permissions↗2011-10-03
▶