[ GLSA 200907-13 ] PulseAudio: Local privilege escalation

[GLSA]

Gentoo Linux Security Advisory

Title: PulseAudio: Local privilege escalation (GLSA 200907-13)
Severity: high
Exploitable: local
Date: July 16, 2009
Bug(s): #276986
ID: 200907-13

Synopsis


A vulnerability in PulseAudio may allow a local user to execute code with
escalated privileges.


Background


PulseAudio is a network-enabled sound server with an advanced plug-in
system.


Affected Packages

Package: media-sound/pulseaudio
Vulnerable: < 0.9.9-r54
Unaffected: >= 0.9.9-r54
Architectures: All supported architectures


Description


Tavis Ormandy and Julien Tinnes of the Google Security Team discovered
that the pulseaudio binary is installed setuid root, and does not drop
privileges before re-executing itself. The vulnerability has
independently been reported to oCERT by Yorick Koster.


Impact


A local user who has write access to any directory on the file system
containing /usr/bin can exploit this vulnerability using a race
condition to execute arbitrary code with root privileges.


Workaround


Ensure that the file system holding /usr/bin does not contain
directories that are writable for unprivileged users.


Resolution


All PulseAudio users should upgrade to the latest version: