Bug 425481 (CVE-2008-0008)

Summary: CVE-2008-0008 Pulseaudio ignores setuid() return value
Product: [Fedora] Fedora Reporter: Lubomir Kundrak <lkundrak>
Component: pulseaudioAssignee: Lennart Poettering <lpoetter>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: 8CC: pierre-bugzilla
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 0.9.8-5.fc8 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-01-24 21:59:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Fail when it's not possible to drop root privileges
none
Fail when it's not possible to drop root privileges none

Description Lubomir Kundrak 2007-12-14 21:34:09 UTC 
The SUSE bug [1] states that we don't check a return value of setuid() to see if
we were able to drop privilegies. User can cause the call to fail by exhausting
the resources in some cases, please add the check. Thanks!

[1] https://bugzilla.novell.com/show_bug.cgi?id=347822
Comment 1 Lubomir Kundrak 2007-12-20 12:40:23 UTC 
Created attachment 290146 [details]
Fail when it's not possible to drop root privileges

Lennart -- could it be done like this?
Comment 2 Lubomir Kundrak 2008-01-23 15:15:13 UTC 
Created attachment 292647 [details]
Fail when it's not possible to drop root privileges
Comment 3 Lennart Poettering 2008-01-24 01:24:45 UTC 
That patch is fine! Lubomir, thanks a lot for fixing this much faster than I could.

I have now merged a different patch into upstream SVN, because I initially
wasn't aware of yours. But yours is fine, too.

http://pulseaudio.org/changeset/2100
Comment 4 Fedora Update System 2008-01-24 21:59:25 UTC 
pulseaudio-0.9.8-5.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2008-01-24 22:01:58 UTC 
pulseaudio-0.9.6-2.fc7.1 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.