cdrecord in the cdrtools package before 2.01, when installed setuid root, does not properly drop privileges before executing a program specified in the RSH environment variable, which allows local users to gain privileges.

The remote host is affected by the vulnerability described in GLSA-200409-18 (cdrtools: Local root vulnerability in cdrecord if set SUID root)

    Max Vozeler discovered that the cdrecord utility, when set to SUID root,     fails to drop root privileges before executing a user-supplied RSH program.
    By default, Gentoo does not ship the cdrecord utility as SUID root and     therefore is not vulnerable. However, many users (and CD-burning     front-ends) set this manually after installation.
  Impact :

    A local attacker could specify a malicious program using the $RSH     environment variable and have it executed by the SUID cdrecord, resulting     in root privileges escalation.
  Workaround :

    As a workaround, you could remove the SUID rights from your cdrecord     utility :
    # chmod a-s /usr/bin/cdrecord

Anyone who has manually suid /usr/bin/cdrecord should update to this version.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0806

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Max Vozeler found that the cdrecord program, which is suid root, fails to drop euid=0 when it exec()s a program specified by the user through the $RSH environment variable. This can be abused by a local attacker to obtain root privileges.

The updated packages are patched to fix the vulnerability.

ID	Name	Product	Family	Severity
14746	GLSA-200409-18 : cdrtools: Local root vulnerability in cdrecord if set SUID root	Nessus	Gentoo Local Security Checks	high
14702	Fedora Core 2 : cdrtools-2.01-0.a27.4.FC2.3 (2004-298)	Nessus	Fedora Local Security Checks	high
14701	Fedora Core 1 : cdrtools-2.01-0.a19.2.FC1.1 (2004-297)	Nessus	Fedora Local Security Checks	high
14680	Mandrake Linux Security Advisory : cdrecord (MDKSA-2004:091)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2004-0806

high

Tenable Plugins

high

high

high

high