MDVSA-2009:171
- Package name
- pulseaudio
- Date
- 2009-07-28
- Advisory ID
- MDVSA-2009:171
- Affected versions
- MES5 i586 , MES5 x86_64
Problem description
A vulnerability has been found and corrected in pulseaudio:
Tavis Ormandy and Julien Tinnes of the Google Security Team discovered
that pulseaudio, when installed setuid root, does not drop privileges
before re-executing itself to achieve immediate bindings. This can
be exploited by a user who has write access to any directory on the
file system containing /usr/bin to gain local root access. The user
needs to exploit a race condition related to creating a hard link
(CVE-2009-1894).
This update provides fixes for this vulnerability.
Updated packages
MES5 i586
35263da527d3c116f4ee3b4c8d731aff mes5/i586/libpulseaudio0-0.9.10-11.2mdvmes5.i586.rpm a59af74d922905188fdf4ea178932dce mes5/i586/libpulseaudio-devel-0.9.10-11.2mdvmes5.i586.rpm f7d6650755863d585ba8c6abea12abcf mes5/i586/libpulsecore5-0.9.10-11.2mdvmes5.i586.rpm 8144b5ede76f077807b9d9098edc8a3f mes5/i586/libpulseglib20-0.9.10-11.2mdvmes5.i586.rpm 5a3caa0bde6750f2f9ab0c2f85364efd mes5/i586/libpulsezeroconf0-0.9.10-11.2mdvmes5.i586.rpm 5c390e77f1af097d842fa40ae624e11c mes5/i586/pulseaudio-0.9.10-11.2mdvmes5.i586.rpm 7f3d1edcfb4b94fde8492a66f6b4c128 mes5/i586/pulseaudio-esound-compat-0.9.10-11.2mdvmes5.i586.rpm 8076ecc212249f68c12ac52a0678562d mes5/i586/pulseaudio-module-bluetooth-0.9.10-11.2mdvmes5.i586.rpm 0b7509c4e072ffbc14bb8587b0b71005 mes5/i586/pulseaudio-module-gconf-0.9.10-11.2mdvmes5.i586.rpm 03a187bcd569dcbb9746109f17b3f874 mes5/i586/pulseaudio-module-jack-0.9.10-11.2mdvmes5.i586.rpm 0b8b4b195cdf034935c6d3c2893c050a mes5/i586/pulseaudio-module-lirc-0.9.10-11.2mdvmes5.i586.rpm f15e18927d01349322a68243461e8d96 mes5/i586/pulseaudio-module-x11-0.9.10-11.2mdvmes5.i586.rpm 690aa7991fd65543b7d66946e17a4e13 mes5/i586/pulseaudio-module-zeroconf-0.9.10-11.2mdvmes5.i586.rpm 1b5ef05e4d872714b3120928712cfa74 mes5/i586/pulseaudio-utils-0.9.10-11.2mdvmes5.i586.rpm 8dd24c52eddc3e726571e7744ca11fa1 mes5/SRPMS/pulseaudio-0.9.10-11.2mdvmes5.src.rpm
MES5 x86_64
e523b867171192dcbebe665ca3a39879 mes5/x86_64/lib64pulseaudio0-0.9.10-11.2mdvmes5.x86_64.rpm b4a9a98a88f012e6d4fe1e4f9641ba72 mes5/x86_64/lib64pulseaudio-devel-0.9.10-11.2mdvmes5.x86_64.rpm 00b5d21e69f9a1a381eaa5e270135400 mes5/x86_64/lib64pulsecore5-0.9.10-11.2mdvmes5.x86_64.rpm 529cd0903d2834f430dfbddfa1ae4518 mes5/x86_64/lib64pulseglib20-0.9.10-11.2mdvmes5.x86_64.rpm 20cb6eb254ceefd42bc3a2b9cf99b5c4 mes5/x86_64/lib64pulsezeroconf0-0.9.10-11.2mdvmes5.x86_64.rpm d381b7945a67a740ca386b44375fac7a mes5/x86_64/pulseaudio-0.9.10-11.2mdvmes5.x86_64.rpm 0534b9d40644a689a6c9d2804dc33d0a mes5/x86_64/pulseaudio-esound-compat-0.9.10-11.2mdvmes5.x86_64.rpm 69dc0286ad6d48709afa6b89cd77d372 mes5/x86_64/pulseaudio-module-bluetooth-0.9.10-11.2mdvmes5.x86_64.rpm 6498bc00b71e2108511e9e9869f8cbb0 mes5/x86_64/pulseaudio-module-gconf-0.9.10-11.2mdvmes5.x86_64.rpm ac05f2c0583ffd90998547f9fcf6c694 mes5/x86_64/pulseaudio-module-jack-0.9.10-11.2mdvmes5.x86_64.rpm ce28fc14459e5acd902ba47376337c58 mes5/x86_64/pulseaudio-module-lirc-0.9.10-11.2mdvmes5.x86_64.rpm 4365ea42d1984105dc7be39ba7e9188f mes5/x86_64/pulseaudio-module-x11-0.9.10-11.2mdvmes5.x86_64.rpm ff98c415fa77bd333aa5e6b5b456a916 mes5/x86_64/pulseaudio-module-zeroconf-0.9.10-11.2mdvmes5.x86_64.rpm 09e2752435aa07c91f548a3f9ccdb1dc mes5/x86_64/pulseaudio-utils-0.9.10-11.2mdvmes5.x86_64.rpm 8dd24c52eddc3e726571e7744ca11fa1 mes5/SRPMS/pulseaudio-0.9.10-11.2mdvmes5.src.rpm