CVE-2008-0008

Published: Jan 29, 2008Modified: Apr 23, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.

Affected (2)

Products: Pulseaudio: Pulseaudio

1 product

Configuration A

2 vulnerable · 6 platform

Vulnerable Software	Affected Versions
Pulseaudio Pulseaudio	Version 0.9.6
Pulseaudio Pulseaudio	Version 0.9.8

Running on/with	Platform Versions
Mandrakesoft Mandrake Linux	Version 2007.1
Mandrakesoft Mandrake Linux	Version 2007.1
Mandrakesoft Mandrake Linux	Version 2008.0
Mandrakesoft Mandrake Linux	Version 2008.0
Redhat Fedora	Version 7
Redhat Fedora	Version 8

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (36)

http://bugs.gentoo.org/show_bug.cgi?id=207214

Source: secalert@redhat.com

Third Party Advisory

http://pulseaudio.org/changeset/2100

Source: secalert@redhat.com

Exploit

http://secunia.com/advisories/28608

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28623

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28738

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/28952

Source: secalert@redhat.com

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200802-07.xml

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2008/dsa-1476

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:027

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/27449

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-573-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2008/0283

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.novell.com/show_bug.cgi?id=347822

Source: secalert@redhat.com

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=425481

Source: secalert@redhat.com

Issue Tracking

https://exchange.xforce.ibmcloud.com/vulnerabilities/39992

Source: secalert@redhat.com

VDB Entry

https://tango.0pointer.de/pipermail/pulseaudio-discuss/2008-January/001228.html

Source: secalert@redhat.com

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00852.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00869.html

Source: secalert@redhat.com

Third Party Advisory

http://bugs.gentoo.org/show_bug.cgi?id=207214

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://pulseaudio.org/changeset/2100

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://secunia.com/advisories/28608

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/28623

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/28738

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/28952

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200802-07.xml

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2008/dsa-1476

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:027

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/bid/27449

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-573-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.vupen.com/english/advisories/2008/0283

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.novell.com/show_bug.cgi?id=347822

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=425481

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://exchange.xforce.ibmcloud.com/vulnerabilities/39992

Source: af854a3a-2127-422b-91ae-364da2661108

VDB Entry

https://tango.0pointer.de/pipermail/pulseaudio-discuss/2008-January/001228.html

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00852.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00869.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.