The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the ownership and permissions of arbitrary files via a symlink attack on a /tmp/.esd-##### temporary file.

The remote host is affected by the vulnerability described in GLSA-201402-10 (PulseAudio: Insecure temporary file usage)

    The pa_make_secure_dir function in core-util.c does not handle temporary       files securely.
  Impact :

    A local attacker could perform symlink attacks to overwrite arbitrary       files with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the ownership and permissions of arbitrary files via a symlink attack on a /tmp/.esd-##### temporary file (CVE-2009-1299).

This update fixes this issue.

Due to a race condition in pulseaudio a local attacker could make pulseaudio change ownership and permissions of arbitrary files. The problem is only security relevant if pulseaudio is run in 'system mode' which is not the case by default (CVE-2009-1299).

This update also improves some latency problems with pulseaudio.

Due to a race condition in pulseaudio a local attacker could make pulseaudio change ownership and permissions of arbitrary files. The problem is only security relevant if pulseaudio is run in 'system mode' which is not the case by default (CVE-2009-1299).

Dan Rosenberg discovered that the PulseAudio sound server creates a temporary directory with a predictable name. This allows a local attacker to create a Denial of Service condition or possibly disclose sensitive information to unprivileged users.

ID	Name	Product	Family	Severity
72410	GLSA-201402-10 : PulseAudio: Insecure temporary file usage	Nessus	Gentoo Local Security Checks	medium
47127	Mandriva Linux Security Advisory : pulseaudio (MDVSA-2010:124)	Nessus	Mandriva Local Security Checks	medium
45103	openSUSE Security Update : libpulse-browse0 (libpulse-browse0-2131)	Nessus	SuSE Local Security Checks	medium
45100	openSUSE Security Update : libpulse-browse0 (libpulse-browse0-2129)	Nessus	SuSE Local Security Checks	medium
45097	openSUSE Security Update : libpulse-browse0 (libpulse-browse0-2129)	Nessus	SuSE Local Security Checks	medium
45062	Debian DSA-2017-1 : pulseaudio - insecure temporary directory	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2009-1299

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium