Description
artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges.
References
- ADV-2006-2357 vdb-entry
- 20899 third-party-advisory
- 26506 vdb-entry
- MDKSA-2006:107 vendor-advisory
- 1016298 vdb-entry
- GLSA-200606-22 vendor-advisory
- 20868 third-party-advisory
- 20060615 rPSA-2006-0105-1 arts mailing-list
- 20786 third-party-advisory
- GLSA-200704-22 vendor-advisory
- ADV-2007-0409 vdb-entry
- 20677 third-party-advisory
- 23697 vdb-entry
- 25059 third-party-advisory
- arts-artwrapper-privilege-escalation(27221) vdb-entry
- 20827 third-party-advisory
- SUSE-SR:2006:015 vendor-advisory
- 25032 third-party-advisory
- http://www.kde.org/info/security/advisory-20060614-2.txt
- [beast] 20061228 ANNOUNCE: BEAST/BSE v0.7.1 mailing-list
- http://dot.kde.org/1150310128/
- 18429 vdb-entry
- SSA:2006-178-03 vendor-advisory