SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Multimedia)  >   cdrtools Vendors:   Schilling, J.
(Mandrake Issues Fix) cdrtools Lets Local Users Obtain Root Privileges
SecurityTracker Alert ID:  1011189
SecurityTracker URL:  http://securitytracker.com/id/1011189
CVE Reference:   CVE-2004-0806   (Links to External Site)
Date:  Sep 8 2004
Impact:   Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.00.3
Description:   A vulnerability was reported in cdrecord (cdrtools). A local user may be able to obtain elevated privileges.

A linux distribution vendor reported that a local user can exploit a flaw in cdrecord to obtain root privileges on the target system.

Max Vozeler is credited with discovering this flaw.

Impact:   A local user can obtain root privileges.
Solution:   Mandrake has released a fix.

Mandrakelinux 10.0:
4b5efe36a9a154b70e62da203c21fb48 10.0/RPMS/cdrecord-2.01-0.a28.2.100mdk.i586.rpm
793909d6cce70205939fdb0b48f037e5 10.0/RPMS/cdrecord-cdda2wav-2.01-0.a28.2.100mdk.i586.rpm
7dd067450567cf5d9a18233fe2379a5d 10.0/RPMS/cdrecord-devel-2.01-0.a28.2.100mdk.i586.rpm
1bd94d54eed67497a8427f91239538e5 10.0/RPMS/mkisofs-2.01-0.a28.2.100mdk.i586.rpm
6afbd923794d2af44ef2e248e361382b 10.0/SRPMS/cdrecord-2.01-0.a28.2.100mdk.src.rpm

Mandrakelinux 10.0/AMD64:
df08036127fd28e366fa6669ed59f88b amd64/10.0/RPMS/cdrecord-2.01-0.a28.2.100mdk.amd64.rpm
f0b5a254593697ef0ac13f7574cf536f amd64/10.0/RPMS/cdrecord-cdda2wav-2.01-0.a28.2.100mdk.amd64.rpm
ec1c76a1b4977e4f6e45dd097f7a45ef amd64/10.0/RPMS/cdrecord-devel-2.01-0.a28.2.100mdk.amd64.rpm
4ec3142c182f957a6d344b375d626320 amd64/10.0/RPMS/mkisofs-2.01-0.a28.2.100mdk.amd64.rpm
6afbd923794d2af44ef2e248e361382b amd64/10.0/SRPMS/cdrecord-2.01-0.a28.2.100mdk.src.rpm

Mandrakelinux 9.2:
e891b428d8a011447eb6462dca30514e 9.2/RPMS/cdrecord-2.01-0.a18.2.1.92mdk.i586.rpm
9778aa9258911700bffe590be69e3782 9.2/RPMS/cdrecord-cdda2wav-2.01-0.a18.2.1.92mdk.i586.rpm
2cdd7b8f33dd7f7ce0c08aa682498891 9.2/RPMS/cdrecord-devel-2.01-0.a18.2.1.92mdk.i586.rpm
78b0c2cb0b529a54eb4607f4305809d1 9.2/RPMS/mkisofs-2.01-0.a18.2.1.92mdk.i586.rpm
3ede5ae3288520fc3a51c63cd05cc3db 9.2/SRPMS/cdrecord-2.01-0.a18.2.1.92mdk.src.rpm

Mandrakelinux 9.2/AMD64:
c5306547c4f1221f3fd787d2b09dfa32 amd64/9.2/RPMS/cdrecord-2.01-0.a18.2.1.92mdk.amd64.rpm
5abf5f3fad0ec3d05f923c88c2255827 amd64/9.2/RPMS/cdrecord-cdda2wav-2.01-0.a18.2.1.92mdk.amd64.rpm
b23bc43f135cc19254c81cf96e793780 amd64/9.2/RPMS/cdrecord-devel-2.01-0.a18.2.1.92mdk.amd64.rpm
86e60c70ee807846ace4b7e2a7e5db7a amd64/9.2/RPMS/mkisofs-2.01-0.a18.2.1.92mdk.amd64.rpm
3ede5ae3288520fc3a51c63cd05cc3db amd64/9.2/SRPMS/cdrecord-2.01-0.a18.2.1.92mdk.src.rpm

Vendor URL:  www.fokus.fhg.de/research/cc/glone/employees/joerg.schilling/private/cdrecord.html (Links to External Site)
Cause:   Not specified
Underlying OS:  Linux (Mandriva/Mandrake)
Underlying OS Comments:  9.2, 10.0

Message History:   This archive entry is a follow-up to the message listed below.
Aug 30 2004 cdrtools Lets Local Users Obtain Root Privileges



 Source Message Contents

Subject:  [Security Announce] MDKSA-2004:091 - Updated cdrecord packages


This is a multi-part message in MIME format...

------------=_1094609020-12666-3352

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           cdrecord
 Advisory ID:            MDKSA-2004:091
 Date:                   September 7th, 2004

 Affected versions:	 10.0, 9.2
 ______________________________________________________________________

 Problem Description:

 Max Vozeler found that the cdrecord program, which is suid root, fails
 to drop euid=0 when it exec()s a program specified by the user through
 the $RSH environment variable.  This can be abused by a local attacker
 to obtain root privileges.
 
 The updated packages are patched to fix the vulnerability.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0806
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 4b5efe36a9a154b70e62da203c21fb48  10.0/RPMS/cdrecord-2.01-0.a28.2.100mdk.i586.rpm
 793909d6cce70205939fdb0b48f037e5  10.0/RPMS/cdrecord-cdda2wav-2.01-0.a28.2.100mdk.i586.rpm
 7dd067450567cf5d9a18233fe2379a5d  10.0/RPMS/cdrecord-devel-2.01-0.a28.2.100mdk.i586.rpm
 1bd94d54eed67497a8427f91239538e5  10.0/RPMS/mkisofs-2.01-0.a28.2.100mdk.i586.rpm
 6afbd923794d2af44ef2e248e361382b  10.0/SRPMS/cdrecord-2.01-0.a28.2.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 df08036127fd28e366fa6669ed59f88b  amd64/10.0/RPMS/cdrecord-2.01-0.a28.2.100mdk.amd64.rpm
 f0b5a254593697ef0ac13f7574cf536f  amd64/10.0/RPMS/cdrecord-cdda2wav-2.01-0.a28.2.100mdk.amd64.rpm
 ec1c76a1b4977e4f6e45dd097f7a45ef  amd64/10.0/RPMS/cdrecord-devel-2.01-0.a28.2.100mdk.amd64.rpm
 4ec3142c182f957a6d344b375d626320  amd64/10.0/RPMS/mkisofs-2.01-0.a28.2.100mdk.amd64.rpm
 6afbd923794d2af44ef2e248e361382b  amd64/10.0/SRPMS/cdrecord-2.01-0.a28.2.100mdk.src.rpm

 Mandrakelinux 9.2:
 e891b428d8a011447eb6462dca30514e  9.2/RPMS/cdrecord-2.01-0.a18.2.1.92mdk.i586.rpm
 9778aa9258911700bffe590be69e3782  9.2/RPMS/cdrecord-cdda2wav-2.01-0.a18.2.1.92mdk.i586.rpm
 2cdd7b8f33dd7f7ce0c08aa682498891  9.2/RPMS/cdrecord-devel-2.01-0.a18.2.1.92mdk.i586.rpm
 78b0c2cb0b529a54eb4607f4305809d1  9.2/RPMS/mkisofs-2.01-0.a18.2.1.92mdk.i586.rpm
 3ede5ae3288520fc3a51c63cd05cc3db  9.2/SRPMS/cdrecord-2.01-0.a18.2.1.92mdk.src.rpm

 Mandrakelinux 9.2/AMD64:
 c5306547c4f1221f3fd787d2b09dfa32  amd64/9.2/RPMS/cdrecord-2.01-0.a18.2.1.92mdk.amd64.rpm
 5abf5f3fad0ec3d05f923c88c2255827  amd64/9.2/RPMS/cdrecord-cdda2wav-2.01-0.a18.2.1.92mdk.amd64.rpm
 b23bc43f135cc19254c81cf96e793780  amd64/9.2/RPMS/cdrecord-devel-2.01-0.a18.2.1.92mdk.amd64.rpm
 86e60c70ee807846ace4b7e2a7e5db7a  amd64/9.2/RPMS/mkisofs-2.01-0.a18.2.1.92mdk.amd64.rpm
 3ede5ae3288520fc3a51c63cd05cc3db  amd64/9.2/SRPMS/cdrecord-2.01-0.a18.2.1.92mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFBPmRHmqjQ0CJFipgRAuR8AJ48LsbY9mkOay+E64emQRBKPD3tjwCgxrHt
LxC0Bd6qNXxIZMQEUbUTciA=
=SkBU
-----END PGP SIGNATURE-----


------------=_1094609020-12666-3352
Content-Type: text/plain; name="message.footer"
Content-Disposition: inline; filename="message.footer"
Content-Transfer-Encoding: 8bit

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________

------------=_1094609020-12666-3352--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC