Gentoo Linux Security Advisory GLSA 200802-07 - Marcus Meissner from SUSE reported that the pa_drop_root() function does not properly check the return value of the system calls setuid(), seteuid(), setresuid() and setreuid() when dropping its privileges. Versions less than 0.9.9 are affected.
553d94f93fd8dffc1d3689adebc35253dc0332b26a4eee04b99e180726d42b7aUbuntu Security Notice 573-1 - It was discovered that PulseAudio did not properly drop privileges when running as a daemon. Local users may be able to exploit this and gain privileges. The default Ubuntu configuration is not affected.
ab4a2b7af6bc38fe408c4489d0f92d4d68b95e2bac578277fca47fe86dfd9211Debian Security Advisory 1476-1 - Marcus Meissner discovered that the PulseAudio sound server performed insufficient checks when dropping privileges, which could lead to local privilege escalation.
79f4f6a4708e4996f23285eb55ae4f15bf089d97e6f67ead00f9b8de74101c61Mandriva Linux Security Advisory - A programming flaw was found in Pulseaudio versions older than 0.9.9, by which a local user can gain root access, if pulseaudio is installed as a setuid to root binary, which is the recommended configuration.
381c4f1e95696b6696489b294e2642f56831ceb6a838555eea63d08b0115a1d8
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed