[ MDVSA-2008:027 ] - Updated pulseaudio packages fix local root vulnerability

2008-01-27T00:00:00
ID SECURITYVULNS:DOC:18958
Type securityvulns
Reporter Securityvulns
Modified 2008-01-27T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2008:027 http://www.mandriva.com/security/


Package : pulseaudio Date : January 25, 2008 Affected: 2007.1, 2008.0


Problem Description:

A programming flaw was found in Pulseaudio versions older than 0.9.9, by which a local user can gain root access, if pulseaudio is installed as a setuid to root binary, which is the recommended configuration.

The updated packages fix this issue.


References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0008


Updated Packages:

Mandriva Linux 2007.1: 52f138a98db13ca5eb3d9a37b9b8efe0 2007.1/i586/libpulseaudio0-0.9.5-1.2mdv2007.1.i586.rpm f48d1b6b61fa0c52406b76c010604f00 2007.1/i586/libpulseaudio0-devel-0.9.5-1.2mdv2007.1.i586.rpm baa1c32f82d6925d3533c4d848fe0785 2007.1/i586/libpulsecore2-0.9.5-1.2mdv2007.1.i586.rpm 55bbdfcca0c7809ee8a1e0ddf4b6e15d 2007.1/i586/pulseaudio-0.9.5-1.2mdv2007.1.i586.rpm 8e833b7c732943d2ef143e35acf2f4e1 2007.1/SRPMS/pulseaudio-0.9.5-1.2mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64: 25a669614bfe39badacd0e9c9adaa0ab 2007.1/x86_64/lib64pulseaudio0-0.9.5-1.2mdv2007.1.x86_64.rpm f93980d7641d4aafd0f51b83a665d9c3 2007.1/x86_64/lib64pulseaudio0-devel-0.9.5-1.2mdv2007.1.x86_64.rpm 0f1442574974705cb4508432c5d2a958 2007.1/x86_64/lib64pulsecore2-0.9.5-1.2mdv2007.1.x86_64.rpm 96f6df3186f6622e68178fc238a8396f 2007.1/x86_64/pulseaudio-0.9.5-1.2mdv2007.1.x86_64.rpm 8e833b7c732943d2ef143e35acf2f4e1 2007.1/SRPMS/pulseaudio-0.9.5-1.2mdv2007.1.src.rpm

Mandriva Linux 2008.0: 47d86f290ace043d9afff832167fd4e9 2008.0/i586/libpulseaudio0-0.9.6-3.2mdv2008.0.i586.rpm 1b8bdf5f12c0b49700f99fa548af8097 2008.0/i586/libpulseaudio0-devel-0.9.6-3.2mdv2008.0.i586.rpm 0da7faa98ccb33abf6ab01be9196532a 2008.0/i586/libpulsecore3-0.9.6-3.2mdv2008.0.i586.rpm 134fdecb71eb1a9486be1fb50f2a9dd1 2008.0/i586/pulseaudio-0.9.6-3.2mdv2008.0.i586.rpm ec9296a94a1f5ddb68f07e1188ed6fbd 2008.0/SRPMS/pulseaudio-0.9.6-3.2mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64: 32b199e39787b69263fb4ad12fc406f2 2008.0/x86_64/lib64pulseaudio0-0.9.6-3.2mdv2008.0.x86_64.rpm 290bc9b8b5088dc34dcb4bc759de0674 2008.0/x86_64/lib64pulseaudio0-devel-0.9.6-3.2mdv2008.0.x86_64.rpm 1156bbd6a875bfe3039dd4a4c0bbd7c3 2008.0/x86_64/lib64pulsecore3-0.9.6-3.2mdv2008.0.x86_64.rpm 2e4058e6aa6b0c87340e71b491f3f494 2008.0/x86_64/pulseaudio-0.9.6-3.2mdv2008.0.x86_64.rpm ec9296a94a1f5ddb68f07e1188ed6fbd 2008.0/SRPMS/pulseaudio-0.9.6-3.2mdv2008.0.src.rpm


To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com


Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFHmlCKmqjQ0CJFipgRApSzAJ98ybCvdBytqs44lj4rhDhjNLeWjwCeObM6 YuDhSanGTkSC5wxyBN23m0k= =CYxH -----END PGP SIGNATURE-----