Unscored severity · published Jan 29, 2008
CVE-2008-0008
The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when…
–
CVSS
0.6%
EPSS
No
On KEV
Description
The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Pulseaudio · Pulseaudio
0.9.6; 0.9.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-0008
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-0008
Third Party Advisory
http://bugs.gentoo.org/show_bug.cgi?id=207214
Exploit
http://pulseaudio.org/changeset/2100
Vendor Advisory
http://secunia.com/advisories/28608
Vendor Advisory
http://secunia.com/advisories/28623
Vendor Advisory
http://secunia.com/advisories/28738
Vendor Advisory
http://secunia.com/advisories/28952
More from Pulseaudio
4.0
CVE-2024-11586
Ubuntu's implementation of pulseaudio can be crashed by a malicious program if a bluetooth headset is connected
3.3
CVE-2020-11931
An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps…
–
CVE-2014-3970
The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure…
–
CVE-2009-1299
The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19 allows local users to change the ownership and permissions of arbitrary files via a symlink attack…
–
CVE-2009-1894
Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link, related to the application setting…