Bugzilla Bug 92494

Description:
A vulnerability has been reported in cdrdao, which potentially can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to an unspecified error, which may be exploited to gain root privileges.

Successful exploitation requires that cdrdao has been installed setuid root.

Solution:
Update to version 1.2.0.
http://sourceforge.net/project/showfiles.php?group_id=2171

From ChangeLog:

 o  SECURITY FIX: cdrdao now gives up its root privileges after setting
    up real-time scheduling, as well as before saving settings through
    the --save option. This fixes a potential local root exploit when
    cdrdao is installed with the +s chmod flag. Using --save now also
    forces an early exit after the settings are saved.

Lars please bump.

correcting component

Vorlon afaik this only makes cdr drop privs, there is no known vuln fixed as
such, no?

Lars please bump.

Lars any news on this one? 

Stupid cdrdao-homepage.  The 1.2.0-version is listed in sourceforge, but not on
their homepage.

I currently try to install 1.2.0 with the latest 1.1.9-ebuild.

Two things:
1) The vulnerability works only with cdrdao installed setuid root (as the first
posting states).  This is not the default within Gentoo.

2) As an information in advance:
The gnome interface gcdmaster which can be built with cdrdao needs the following
packages stable for version cdrdao-1.2.0:

>=dev-cpp/gconfmm-2.6
>=dev-cpp/libglademm-2.4
>=dev-cpp/gnome-vfsmm-2.6
>=dev-cpp/libgnomecanvasmm-2.6
>=dev-cpp/libgnomemm-2.6
>=dev-cpp/libgnomeuimm-2.6

These are all gnome-herd packages.  Please ask if the packages are ready for
stable usage.

I'll add a testing masked version of cdrdao-1.2.0 as soon as it has been
compiled on my machine.

Added gnome to CC like requested by foser - he will take a look when he has
some
time.

any news on this one?

foser/pylon any news on this one? 

See my comment #6.  I'm waiting for the gnome-herd masking some packages
stable.
 Otherwise a newer cdrdao won't become stable.

These are all owned by the gnome-mm herd, adding to cc.

I'll work on the others, but pYrania maintains gnome-vfsmm.

>=dev-cpp/gconfmm-2.6 <- done
>=dev-cpp/libglademm-2.4 <- done earlier this week
>=dev-cpp/gnome-vfsmm-2.6 <- waiting on pYrania
>=dev-cpp/libgnomecanvasmm-2.6 <- done by someone else at some point
>=dev-cpp/libgnomemm-2.6 <- done
>=dev-cpp/libgnomeuimm-2.6 <- waiting on gnome-vfsmm stable

>=dev-cpp/gnome-vfsmm-2.6 <- it's stable now on x86.  Now we can get
>=dev-cpp/libgnomeuimm-2.6 stable.

ppc, ppc64 and sparc are already ready for the cdrdao-upgrade.  There is no
other open bug from it's testing phase.  When all dependencies are done for x86,
I'll mask cdrdao-1.2.0 stable.

dev-cpp/libgnomeuimm-2.6.0 stable on x86

cdrdao-1.2.0 stable on x86 and ppc.  Other arches should test and upgrade to
cdrdao-1.2.0.

Arches, please test and make stable cdrdao-1.2.0.

Current keywords:
cdrdao-1.2.0:  ~amd64 ppc ~ppc64 ~sparc x86
Target keywords:
cdrdao-1.2.0:  alpha amd64 hppa ia64 ppc ppc64 sparc x86

I previously dropped the alpha, hppa and ia64 keyword for this version as it
contains major changes.

stable on ppc64

Stable on amd64.

sparc stable.

LLoydBates reported a minor problem with the ebuild, it adds 1.1.9 as version,
not 1.2.0:
# Add gentoo to version
sed -i -e "s:^PACKAGE_STRING='cdrdao 1.1.9':PACKAGE_STRING='cdrdao 1.1.9
gentoo':" configure

Removing remaining arches until another ebuild comes so that they can spend
their time for other bugs ;)

Fix done (and in a way, it should not happen again ;-) ).

Remaining arches are alpha, hppa and ia64.

Alpha, ia64, hppa: please mark cdrdao-1.2.0 stable, thanks!

We (hppa) are working on marking stable this ebuild. But we need further
testing
because of major changes.

Now stable on hppa. Sorry for the delay.

cdrdao is p.masked in alpha until we can mark cdrdao-1.2.0 stable.

Cheers
Ferdy

I guess we can now close this one. Reopen if you disagree.