acpid contains a flaw that may allow a local denial of service. The issue is triggered when the daemon uses a socket in blocking mode to communicate with unprivileged programs, which may be exploited to cause a denial of service.

Currently, there are no known workarounds or vendor upgrades to correct this issue. However, Vasiliy Kulikov has released an unofficial patch to address this vulnerability.

As with all third-party solutions, ensure they come from a reliable source and are permitted under your company's security policy.

• CVE ID: 2011-1159 (see also: NVD)
• Secunia Advisory ID: 42947 44621 46540 47206
• Bugtraq ID: 45915
• Vendor URL: http://acpid.sourceforge.net/
• Vendor Specific News/Changelog Entry: http://lists.debian.org/debian-security-announce/2011/msg00240.html
  https://bugzilla.redhat.com/show_bug.cgi?id=688698
• Mail List Post: http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059880.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060053.html
• Other Advisory URL: http://www.openwall.com/lists/oss-security/2011/01/19/4
  http://www.openwall.com/lists/oss-security/2011/03/15/12
  http://www.openwall.com/lists/oss-security/2011/03/15/7
• Vendor Specific Advisory URL: http://www.ubuntu.com/usn/usn-1234-1/

• Vasiliy Kulikov