PulseAudio: Local privilege escalation

PulseAudio: Local privilege escalation A vulnerability in PulseAudio may allow a local user to execute code with escalated privileges. pulseaudio 2009-07-16 2009-07-16: 01 276986 local 0.9.9-r54 0.9.9-r54

PulseAudio is a network-enabled sound server with an advanced plug-in system.

Tavis Ormandy and Julien Tinnes of the Google Security Team discovered that the pulseaudio binary is installed setuid root, and does not drop privileges before re-executing itself. The vulnerability has independently been reported to oCERT by Yorick Koster.

A local user who has write access to any directory on the file system containing /usr/bin can exploit this vulnerability using a race condition to execute arbitrary code with root privileges.

Ensure that the file system holding /usr/bin does not contain directories that are writable for unprivileged users.

All PulseAudio users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=media-sound/pulseaudio-0.9.9-r54"

CVE-2009-1894 rbu rbu rbu