Paketname
pulseaudio
Datum
2009-07-28
Advisory ID
MDVSA-2009:171
Betroffene Versionen
MES5 i586 , MES5 x86_64

Problembeschreibung

A vulnerability has been found and corrected in pulseaudio:

Tavis Ormandy and Julien Tinnes of the Google Security Team discovered
that pulseaudio, when installed setuid root, does not drop privileges
before re-executing itself to achieve immediate bindings. This can
be exploited by a user who has write access to any directory on the
file system containing /usr/bin to gain local root access. The user
needs to exploit a race condition related to creating a hard link
(CVE-2009-1894).

This update provides fixes for this vulnerability.

Aktualisierte Pakete

MES5 i586

 35263da527d3c116f4ee3b4c8d731aff  mes5/i586/libpulseaudio0-0.9.10-11.2mdvmes5.i586.rpm
 a59af74d922905188fdf4ea178932dce  mes5/i586/libpulseaudio-devel-0.9.10-11.2mdvmes5.i586.rpm
 f7d6650755863d585ba8c6abea12abcf  mes5/i586/libpulsecore5-0.9.10-11.2mdvmes5.i586.rpm
 8144b5ede76f077807b9d9098edc8a3f  mes5/i586/libpulseglib20-0.9.10-11.2mdvmes5.i586.rpm
 5a3caa0bde6750f2f9ab0c2f85364efd  mes5/i586/libpulsezeroconf0-0.9.10-11.2mdvmes5.i586.rpm
 5c390e77f1af097d842fa40ae624e11c  mes5/i586/pulseaudio-0.9.10-11.2mdvmes5.i586.rpm
 7f3d1edcfb4b94fde8492a66f6b4c128  mes5/i586/pulseaudio-esound-compat-0.9.10-11.2mdvmes5.i586.rpm
 8076ecc212249f68c12ac52a0678562d  mes5/i586/pulseaudio-module-bluetooth-0.9.10-11.2mdvmes5.i586.rpm
 0b7509c4e072ffbc14bb8587b0b71005  mes5/i586/pulseaudio-module-gconf-0.9.10-11.2mdvmes5.i586.rpm
 03a187bcd569dcbb9746109f17b3f874  mes5/i586/pulseaudio-module-jack-0.9.10-11.2mdvmes5.i586.rpm
 0b8b4b195cdf034935c6d3c2893c050a  mes5/i586/pulseaudio-module-lirc-0.9.10-11.2mdvmes5.i586.rpm
 f15e18927d01349322a68243461e8d96  mes5/i586/pulseaudio-module-x11-0.9.10-11.2mdvmes5.i586.rpm
 690aa7991fd65543b7d66946e17a4e13  mes5/i586/pulseaudio-module-zeroconf-0.9.10-11.2mdvmes5.i586.rpm
 1b5ef05e4d872714b3120928712cfa74  mes5/i586/pulseaudio-utils-0.9.10-11.2mdvmes5.i586.rpm 
 8dd24c52eddc3e726571e7744ca11fa1  mes5/SRPMS/pulseaudio-0.9.10-11.2mdvmes5.src.rpm

MES5 x86_64

 e523b867171192dcbebe665ca3a39879  mes5/x86_64/lib64pulseaudio0-0.9.10-11.2mdvmes5.x86_64.rpm
 b4a9a98a88f012e6d4fe1e4f9641ba72  mes5/x86_64/lib64pulseaudio-devel-0.9.10-11.2mdvmes5.x86_64.rpm
 00b5d21e69f9a1a381eaa5e270135400  mes5/x86_64/lib64pulsecore5-0.9.10-11.2mdvmes5.x86_64.rpm
 529cd0903d2834f430dfbddfa1ae4518  mes5/x86_64/lib64pulseglib20-0.9.10-11.2mdvmes5.x86_64.rpm
 20cb6eb254ceefd42bc3a2b9cf99b5c4  mes5/x86_64/lib64pulsezeroconf0-0.9.10-11.2mdvmes5.x86_64.rpm
 d381b7945a67a740ca386b44375fac7a  mes5/x86_64/pulseaudio-0.9.10-11.2mdvmes5.x86_64.rpm
 0534b9d40644a689a6c9d2804dc33d0a  mes5/x86_64/pulseaudio-esound-compat-0.9.10-11.2mdvmes5.x86_64.rpm
 69dc0286ad6d48709afa6b89cd77d372  mes5/x86_64/pulseaudio-module-bluetooth-0.9.10-11.2mdvmes5.x86_64.rpm
 6498bc00b71e2108511e9e9869f8cbb0  mes5/x86_64/pulseaudio-module-gconf-0.9.10-11.2mdvmes5.x86_64.rpm
 ac05f2c0583ffd90998547f9fcf6c694  mes5/x86_64/pulseaudio-module-jack-0.9.10-11.2mdvmes5.x86_64.rpm
 ce28fc14459e5acd902ba47376337c58  mes5/x86_64/pulseaudio-module-lirc-0.9.10-11.2mdvmes5.x86_64.rpm
 4365ea42d1984105dc7be39ba7e9188f  mes5/x86_64/pulseaudio-module-x11-0.9.10-11.2mdvmes5.x86_64.rpm
 ff98c415fa77bd333aa5e6b5b456a916  mes5/x86_64/pulseaudio-module-zeroconf-0.9.10-11.2mdvmes5.x86_64.rpm
 09e2752435aa07c91f548a3f9ccdb1dc  mes5/x86_64/pulseaudio-utils-0.9.10-11.2mdvmes5.x86_64.rpm 
 8dd24c52eddc3e726571e7744ca11fa1  mes5/SRPMS/pulseaudio-0.9.10-11.2mdvmes5.src.rpm

Referenzen