CVE-2008-0008

2008-01-2900:00:00

CWE-20

[email protected]

web.nvd.nist.gov

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

6.3

Confidence

Low

EPSS

Percentile

10.1%

JSON

The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.

Affected configurations

Nvd

Node

mandrakesoftmandrake_linuxMatch2007.1

mandrakesoftmandrake_linuxMatch2007.1x86_64

mandrakesoftmandrake_linuxMatch2008.0

mandrakesoftmandrake_linuxMatch2008.0x86_64

redhatfedoraMatch7

redhatfedoraMatch8

AND

pulseaudiopulseaudioMatch0.9.6

pulseaudiopulseaudioMatch0.9.8

VendorProductVersionCPE
mandrakesoftmandrake_linux2007.1cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:*:*:*:*:*:*
mandrakesoftmandrake_linux2007.1cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:*:x86_64:*:*:*:*:*
mandrakesoftmandrake_linux2008.0cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
mandrakesoftmandrake_linux2008.0cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:*:x86_64:*:*:*:*:*
redhatfedora7cpe:2.3:o:redhat:fedora:7:*:*:*:*:*:*:*
redhatfedora8cpe:2.3:o:redhat:fedora:8:*:*:*:*:*:*:*
pulseaudiopulseaudio0.9.6cpe:2.3:a:pulseaudio:pulseaudio:0.9.6:*:*:*:*:*:*:*
pulseaudiopulseaudio0.9.8cpe:2.3:a:pulseaudio:pulseaudio:0.9.8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mandrakesoft	mandrake_linux	2007.1	cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1:::::::*
mandrakesoft	mandrake_linux	2007.1	cpe:2.3:o:mandrakesoft:mandrake_linux:2007.1::x86_64:::::
mandrakesoft	mandrake_linux	2008.0	cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0:::::::*
mandrakesoft	mandrake_linux	2008.0	cpe:2.3:o:mandrakesoft:mandrake_linux:2008.0::x86_64:::::
redhat	fedora	7	cpe:2.3:o:redhat:fedora:7:::::::*
redhat	fedora	8	cpe:2.3:o:redhat:fedora:8:::::::*
pulseaudio	pulseaudio	0.9.6	cpe:2.3:a:pulseaudio:pulseaudio:0.9.6:::::::*
pulseaudio	pulseaudio	0.9.8	cpe:2.3:a:pulseaudio:pulseaudio:0.9.8:::::::*