PT-2008-1682 · Pulseaudio · Pulseaudio
Publicado
2008-01-28
·
Atualizado
2024-06-15
·
CVE-2008-0008
CVSS v2.0
7.2
Alta
| Vetor | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
PulseAudio versions 0.9.8 through 0.9.9
Description
The issue arises from the
pa drop root function not checking return values from calls to setresuid, setreuid, setuid, and seteuid when attempting to drop privileges. This could allow local users to gain privileges by causing these calls to fail through methods like resource exhaustion.Recommendations
For PulseAudio versions 0.9.8 through 0.9.9, consider disabling the
pa drop root function until a patch is available to prevent potential privilege escalation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Pulseaudio