Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link, related to the application setting LD_BIND_NOW to 1, and then calling execv on the target of the /proc/self/exe symlink.

Tavis Ormandy and Julien Tinnes discovered that the pulseaudio daemon does not drop privileges before re-executing itself, enabling local attackers to increase their privileges.

A vulnerability has been found and corrected in pulseaudio :

Tavis Ormandy and Julien Tinnes of the Google Security Team discovered that pulseaudio, when installed setuid root, does not drop privileges before re-executing itself to achieve immediate bindings. This can be exploited by a user who has write access to any directory on the file system containing /usr/bin to gain local root access. The user needs to exploit a race condition related to creating a hard link (CVE-2009-1894).

This update provides fixes for this vulnerability.

Tavis Ormandy, Julien Tinnes, and Yorick Koster discovered that PulseAudio did not safely re-execute itself. A local attacker could exploit this to gain root privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200907-13 (PulseAudio: Local privilege escalation)

    Tavis Ormandy and Julien Tinnes of the Google Security Team discovered     that the pulseaudio binary is installed setuid root, and does not drop     privileges before re-executing itself. The vulnerability has     independently been reported to oCERT by Yorick Koster.
  Impact :

    A local user who has write access to any directory on the file system     containing /usr/bin can exploit this vulnerability using a race     condition to execute arbitrary code with root privileges.
  Workaround :

    Ensure that the file system holding /usr/bin does not contain     directories that are writable for unprivileged users.

ID	Name	Product	Family	Severity
44703	Debian DSA-1838-1 : pulseaudio - privilege escalation	Nessus	Debian Local Security Checks	high
39871	Mandriva Linux Security Advisory : pulseaudio (MDVSA-2009:152)	Nessus	Mandriva Local Security Checks	high
39851	Ubuntu 8.04 LTS / 8.10 / 9.04 : pulseaudio vulnerability (USN-804-1)	Nessus	Ubuntu Local Security Checks	high
39848	GLSA-200907-13 : PulseAudio: Local privilege escalation	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2009-1894

high

Tenable Plugins

high

high

high

high