PT-2010-4766 · Roaraudio · Roaraudio

Raphael Geissert · Published 2010-10-20 · Updated 2010-10-21 · CVE-2010-3363

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions roaraudio version 0.3

Description The issue in roaraudio allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is due to roarify placing a zero-length directory name in the LD LIBRARY PATH.

Recommendations For roaraudio version 0.3, consider restricting access to the LD LIBRARY PATH environment variable to prevent unauthorized modifications, and avoid using the roarify function in untrusted environments until a fix is available.

Exploit

Fix

Related Identifiers

CVE-2010-3363

Affected Products

Roaraudio

References · 5

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598295 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3363 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-3363 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3363 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-3363 · Vendor Advisory