CVE-2006-2916 artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing...
HighCVSS 7.8
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| KDE arts | = 1.0 | No fix listed |
| KDE arts | = 1.2 | No fix listed |
References
- dot.kde.org not-applicable
- [beast] 20061228 ANNOUNCE: BEAST/BSE v0.7.1 mailing-list
- 20677 broken-link third-party-advisory vendor-advisory
- 20786 broken-link third-party-advisory vendor-advisory
- 20827 broken-link third-party-advisory vendor-advisory
- 20868 broken-link third-party-advisory vendor-advisory
- 20899 broken-link third-party-advisory vendor-advisory
- 25032 broken-link third-party-advisory
- 25059 broken-link third-party-advisory
- GLSA-200704-22 third-party-advisory vendor-advisory
- 1016298 broken-link third-party-advisory vdb-entry
- SSA:2006-178-03 mailing-list third-party-advisory vendor-advisory
- GLSA-200606-22 third-party-advisory vendor-advisory
- www.kde.org patch vendor-advisory
- MDKSA-2006:107 third-party-advisory vendor-advisory
- SUSE-SR:2006:015 broken-link vendor-advisory
- 26506 broken-link vdb-entry
- 20060615 rPSA-2006-0105-1 arts broken-link mailing-list third-party-advisory vdb-entry
- 18429 broken-link patch third-party-advisory vdb-entry
- 23697 broken-link third-party-advisory vdb-entry
- ADV-2006-2357 broken-link vdb-entry
- ADV-2007-0409 broken-link vdb-entry
- arts-artwrapper-privilege-escalation(27221) third-party-advisory vdb-entry