CVE-2009-1299

Published: Mar 18, 2010Modified: Apr 29, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the ownership and permissions of arbitrary files via a symlink attack on a /tmp/.esd-##### temporary file.

Affected (2)

Products: Pulseaudio: Pulseaudio

Pulseaudio

1 product

Pulseaudio

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Pulseaudio Pulseaudio	Version 0.9.10
Pulseaudio Pulseaudio	Version 0.9.19

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (12)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=573615

Source: security@ubuntu.com

http://git.0pointer.de/?p=pulseaudio.git%3Ba=patch%3Bh=d3efa43d85ac132c6a5a416a2b6f2115f5d577ee

Source: security@ubuntu.com

http://www.debian.org/security/2010/dsa-2017

Source: security@ubuntu.com

http://www.mandriva.com/security/advisories?name=MDVSA-2010:124

Source: security@ubuntu.com

http://www.vupen.com/english/advisories/2010/1570

Source: security@ubuntu.com

https://bugs.edge.launchpad.net/ubuntu/+source/pulseaudio/+bug/509008

Source: security@ubuntu.com

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=573615