artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges.

The KDE soundserver aRts lacked checks around some setuid() calls.
This could be used by a local attacker to gain root privileges.
(CVE-2006-2916)

The KDE soundserver aRts lacked checks around some setuid() calls.
This could potentially be used by a local attacker to gain root privileges. (CVE-2006-2916)

The remote host is affected by the vulnerability described in GLSA-200704-22 (BEAST: Denial of Service)

    BEAST, which is installed as setuid root, fails to properly check     whether it can drop privileges accordingly if seteuid() fails due to a     user exceeding assigned resource limits.
  Impact :

    A local user could exceed his resource limit in order to prevent the     seteuid() call from succeeding. This may lead BEAST to keep running     with root privileges. Then, the local user could use the 'save as'     dialog box to overwrite any file on the vulnerable system, potentially     leading to a Denial of Service.
  Workaround :

    There is no known workaround at this time.

New aRts packages are available for Slackware 10.0, 10.1, 10.2, and
-current to fix a possible security issue with artswrapper. The artswrapper program and the artsd daemon can be used to gain root privileges if artswrapper is setuid root and the system is running a 2.6.x kernel. Note that artswrapper is not setuid root on Slackware by default. Some people have recommended setting it that way online though, so it's at least worth warning about. It's far safer to just add users to the audio group. The official KDE security advisory may be found here:
http://www.kde.org/info/security/advisory-20060614-2.txt

A vulnerability in the artswrapper program, when installed setuid root, could enable a local user to elevate their privileges to that of root.

By default, Mandriva Linux does not ship artswrapper setuid root, however if a user or system administrator enables the setuid bit on artswrapper, their system could be at risk,

The updated packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200606-22 (aRts: Privilege escalation)

    artswrapper fails to properly check whether it can drop privileges     accordingly if setuid() fails due to a user exceeding assigned resource     limits.
  Impact :

    Local attackers could exploit this vulnerability to execute arbitrary     code with elevated privileges. Note that the aRts package provided by     Gentoo is only vulnerable if the artswrappersuid USE-flag is enabled.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
41092	SuSE9 Security Update : arts (YOU Patch Number 11075)	Nessus	SuSE Local Security Checks	medium
27154	openSUSE 10 Security Update : arts (arts-1670)	Nessus	SuSE Local Security Checks	medium
25110	GLSA-200704-22 : BEAST: Denial of Service	Nessus	Gentoo Local Security Checks	high
21767	Slackware 10.0 / 10.1 / 10.2 / current : arts (SSA:2006-178-03)	Nessus	Slackware Local Security Checks	medium
21751	Mandrake Linux Security Advisory : arts (MDKSA-2006:107)	Nessus	Mandriva Local Security Checks	medium
21742	GLSA-200606-22 : aRts: Privilege escalation	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2006-2916

high

Tenable Plugins

medium

medium

high

medium

medium

medium