Vulnerability Description
artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kde | Arts | 1.0 |
| Linux | Linux Kernel | >= 2.6.0 |
Related Weaknesses (CWE)
References
- http://dot.kde.org/1150310128/Not Applicable
- http://mail.gnome.org/archives/beast/2006-December/msg00025.htmlMailing List
- http://secunia.com/advisories/20677Broken LinkVendor Advisory
- http://secunia.com/advisories/20786Broken LinkVendor Advisory
- http://secunia.com/advisories/20827Broken LinkVendor Advisory
- http://secunia.com/advisories/20868Broken LinkVendor Advisory
- http://secunia.com/advisories/20899Broken LinkVendor Advisory
- http://secunia.com/advisories/25032Broken Link
- http://secunia.com/advisories/25059Broken Link
- http://security.gentoo.org/glsa/glsa-200704-22.xmlThird Party Advisory
- http://securitytracker.com/id?1016298Broken LinkThird Party AdvisoryVDB Entry
- http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackwareMailing ListThird Party Advisory
- http://www.gentoo.org/security/en/glsa/glsa-200606-22.xmlThird Party Advisory
- http://www.kde.org/info/security/advisory-20060614-2.txtPatchVendor Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:107Third Party Advisory
FAQ
What is CVE-2006-2916?
CVE-2006-2916 is a vulnerability with a CVSS score of 7.8 (HIGH). artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing...
How severe is CVE-2006-2916?
CVE-2006-2916 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-2916?
Check the references section above for vendor advisories and patch information. Affected products include: Kde Arts, Linux Linux Kernel.