Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[ GLSA 200907-13 ] PulseAudio: Local privilege escalation
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index News & Announcements
View previous topic :: View next topic  
Author Message
GLSA
Veteran
Veteran


Joined: 12 May 2004
Posts: 1471

PostPosted: Thu Jul 16, 2009 3:26 pm    Post subject: [ GLSA 200907-13 ] PulseAudio: Local privilege escalation Reply with quote

Gentoo Linux Security Advisory

Title: PulseAudio: Local privilege escalation (GLSA 200907-13)
Severity: high
Exploitable: local
Date: July 16, 2009
Bug(s): #276986
ID: 200907-13

Synopsis


A vulnerability in PulseAudio may allow a local user to execute code with
escalated privileges.


Background


PulseAudio is a network-enabled sound server with an advanced plug-in
system.


Affected Packages

Package: media-sound/pulseaudio
Vulnerable: < 0.9.9-r54
Unaffected: >= 0.9.9-r54
Architectures: All supported architectures


Description


Tavis Ormandy and Julien Tinnes of the Google Security Team discovered
that the pulseaudio binary is installed setuid root, and does not drop
privileges before re-executing itself. The vulnerability has
independently been reported to oCERT by Yorick Koster.


Impact


A local user who has write access to any directory on the file system
containing /usr/bin can exploit this vulnerability using a race
condition to execute arbitrary code with root privileges.


Workaround


Ensure that the file system holding /usr/bin does not contain
directories that are writable for unprivileged users.


Resolution


All PulseAudio users should upgrade to the latest version:
Code:
# emerge --sync
    # emerge --ask --oneshot --verbose ">=media-sound/pulseaudio-0.9.9-r54"


References

CVE-2009-1894


Last edited by GLSA on Mon Mar 31, 2014 4:29 am; edited 4 times in total
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index News & Announcements All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum