PT-2005-1186 · Unknown · Synaesthesia

Devin Carraway + 1 · Published 2005-02-16 · Updated 2008-09-05 · CVE-2005-0070

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Synaesthesia versions 2.1 and earlier

Description The issue allows local users to read arbitrary files due to the software not dropping privileges before processing configuration and mixer files when installed setuid root.

Recommendations For Synaesthesia versions 2.1 and earlier, consider dropping privileges before processing configuration and mixer files to prevent unauthorized access. As a temporary workaround, restrict the use of setuid root installation until a proper fix is applied.

Fix

Related Identifiers

CVE-2005-0070

DSA-681-1

Affected Products

Synaesthesia

References · 5

• http://debian.org/security/2005/dsa-681 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0070 · Security Note
• http://securityfocus.com/bid/12546 · Note
• http://securitytracker.com/id?1013206 · Note
• http://secunia.com/advisories/14300 · Note