CVE - CVE-2008-0008

CVE-ID
CVE-2008-0008	Learn more at National Vulnerability Database (NVD) • Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings
Description
The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MLIST:[pulseaudio-discuss] 20080124 [ANNOUNCE] PulseAudio 0.9.9 URL:https://tango.0pointer.de/pipermail/pulseaudio-discuss/2008-January/001228.html CONFIRM:http://pulseaudio.org/changeset/2100 CONFIRM:https://bugzilla.novell.com/show_bug.cgi?id=347822 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=425481 CONFIRM:http://bugs.gentoo.org/show_bug.cgi?id=207214 DEBIAN:DSA-1476 URL:http://www.debian.org/security/2008/dsa-1476 FEDORA:FEDORA-2008-0963 URL:https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00852.html FEDORA:FEDORA-2008-0994 URL:https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00869.html GENTOO:GLSA-200802-07 URL:http://security.gentoo.org/glsa/glsa-200802-07.xml MANDRIVA:MDVSA-2008:027 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2008:027 UBUNTU:USN-573-1 URL:http://www.ubuntu.com/usn/usn-573-1 BID:27449 URL:http://www.securityfocus.com/bid/27449 VUPEN:ADV-2008-0283 URL:http://www.vupen.com/english/advisories/2008/0283 SECUNIA:28623 URL:http://secunia.com/advisories/28623 SECUNIA:28608 URL:http://secunia.com/advisories/28608 SECUNIA:28738 URL:http://secunia.com/advisories/28738 SECUNIA:28952 URL:http://secunia.com/advisories/28952 XF:pulseaudio-padroproot-privilege-escalation(39992) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/39992
Assigning CNA
N/A
Date Entry Created
20071203	Disclaimer: The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20071203)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE list, which standardizes names for security problems.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org