The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.

A programming flaw was found in Pulseaudio versions older than 0.9.9, by which a local user can gain root access, if pulseaudio is installed as a setuid to root binary, which is the recommended configuration.

The updated packages fix this issue.

The remote host is affected by the vulnerability described in GLSA-200802-07 (Pulseaudio: Privilege escalation)

    Marcus Meissner from SUSE reported that the pa_drop_root() function     does not properly check the return value of the system calls setuid(),     seteuid(), setresuid() and setreuid() when dropping its privileges.
  Impact :

    A local attacker could cause a resource exhaustion to make the system     calls fail, which would cause Pulseaudio to run as root. The attacker     could then perform actions with root privileges.
  Workaround :

    There is no known workaround at this time.

It was discovered that PulseAudio did not properly drop privileges when running as a daemon. Local users may be able to exploit this and gain privileges. The default Ubuntu configuration is not affected.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marcus Meissner discovered that the PulseAudio sound server performed insufficient checks when dropping privileges, which could lead to local privilege escalation.

- Wed Jan 23 2008 Lubomir Kundrak <lkundrak at redhat.com>     0.9.6-2.1

    - Fix CVE-2008-0008 security issue (#425481)

    - Tue May 29 2007 Pierre Ossman <drzeus at drzeus.cx>       0.9.6-2

    - Add libatomic_ops-devel as a build requirement.

    - Tue May 29 2007 Pierre Ossman <drzeus at drzeus.cx>       0.9.6-1

    - Upgrade to 0.9.6.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Jan 23 2008 Lubomir Kundrak <lkundrak at redhat.com>     0.9.8-5

    - Fix CVE-2008-0008 security issue (#425481)

    - Sun Jan 13 2008 Lubomir Kundrak <lkundrak at       redhat.com> 0.9.8-4.1

    - Actually add content to       pulseaudio-0.9.8-create-dot-pulse.patch

    - Make the Source0 tag point to URL instead of a local       file

    - Drop the nochown patch; it's not applied at all and no       longer needed

    - Thu Nov 29 2007 Lennart Poettering <lpoetter at       redhat.com> 0.9.8-4

    - add missing dependency on pulseaudio-utils for       pulseaudio-module-x11

    - Thu Nov 29 2007 Lennart Poettering <lpoetter at       redhat.com> 0.9.8-3

    - Create ~/.pulse/ if non-existent

    - Thu Nov 29 2007 Lennart Poettering <lpoetter at       redhat.com> 0.9.8-2

    - Add missing dependency on       jack-audio-connection-kit-devel

    - Wed Nov 28 2007 Lennart Poettering <lpoetter at       redhat.com> 0.9.8-1

    - Upgrade to current upstream

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
37092	Mandriva Linux Security Advisory : pulseaudio (MDVSA-2008:027)	Nessus	Mandriva Local Security Checks	high
31085	GLSA-200802-07 : Pulseaudio: Privilege escalation	Nessus	Gentoo Local Security Checks	high
30147	Ubuntu 7.04 / 7.10 : pulseaudio vulnerability (USN-573-1)	Nessus	Ubuntu Local Security Checks	high
30111	Debian DSA-1476-1 : pulseaudio - programming error	Nessus	Debian Local Security Checks	high
30085	Fedora 7 : pulseaudio-0.9.6-2.fc7.1 (2008-0994)	Nessus	Fedora Local Security Checks	high
30084	Fedora 8 : pulseaudio-0.9.8-5.fc8 (2008-0963)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2008-0008

high

Tenable Plugins

high

high

high

high

high

high