[ advisories | exploits | discussions | news | conventions | security tools | texts & papers ]
 main menu
- feedback
- advertising
- privacy
- FightAIDS
- newsletter
- news
- read forum
- new topic
- search

- meetings list
- recent additions
- add your info
 top 100 sites
- visit top sites
- sign up now
- members

- add your url
- add domain
- search box
- link to us

- our projects
- free email
 m4d network
- security software
- secureroot
- m4d.com
Home : Advisories : apcupsd 3.7.2 Denial of Service

Title: apcupsd 3.7.2 Denial of Service
Released by: Mattias Dartsch
Date: 6th December 2000
Printable version: Click here
Title:    apcupsd 3.7.2 Denial of Service

Affected Application:    apcupsd daemon

Affected Versions:    3.7.2 and maybe prior

Not affected:    3.8.0 and above

Affected Platforms:    all Linux / Unix

Vulnerability Class:    Denial of Service (local)

Author Notified:    Yes    July 12th 2000

Fix available:    Yes (included)


Apcupsd is a daemon for controlling most of APC's UPS models on Unix and

Windows machines. The Unix daemon runs as root and shuts the machine down in

case of a power failure.


During startup apcupsd creates a PID-file named "apcupsd.pid" in /var/run

(system specific, maybe other directory) with the ID of the daemon process,

this PID-file is used by the shutdown-script to kill the daemon process.

Unfortunatly this PID-file ist world-writeable (Mode 666, -rw-rw-rw). A

malicious user can overwrite the file with arbitrary process ID's, these

processes will be killed instead of the apcupsd process during restart or

stop of the apcupsd daemon and during system shutdown or restart, the whole

system can be crashed this way.


Upgrade to apcupsd Version 3.8.0 .

It's available at:




User's who don't want to upgrade can add two lines to the "start" section in

the apcupsd startup script in /etc/rc.d or /sbin/init.d :



        rm -f /etc/apcupsd/powerfail

        rm -f /etc/nologin

        echo -n "Starting apcupsd power management"

        $APCUPSD || return=$rc_failed

        # give the daemon some little time to create the PID-file

        sleep 1

        #now simply chmod the PID-file to Mode 644

        chmod 644 /var/run/apcupsd.pid

        echo -e "$return"



Mattias Dartsch


(C) 1999-2000 All rights reserved.