Description: A vulnerability has been reported in cdrdao, which potentially can be exploited by malicious, local users to gain escalated privileges. The vulnerability is caused due to an unspecified error, which may be exploited to gain root privileges. Successful exploitation requires that cdrdao has been installed setuid root. Solution: Update to version 1.2.0. http://sourceforge.net/project/showfiles.php?group_id=2171
From ChangeLog: o SECURITY FIX: cdrdao now gives up its root privileges after setting up real-time scheduling, as well as before saving settings through the --save option. This fixes a potential local root exploit when cdrdao is installed with the +s chmod flag. Using --save now also forces an early exit after the settings are saved. Lars please bump.
correcting component
Vorlon afaik this only makes cdr drop privs, there is no known vuln fixed as such, no? Lars please bump.
Lars any news on this one?
Stupid cdrdao-homepage. The 1.2.0-version is listed in sourceforge, but not on their homepage. I currently try to install 1.2.0 with the latest 1.1.9-ebuild.
Two things: 1) The vulnerability works only with cdrdao installed setuid root (as the first posting states). This is not the default within Gentoo. 2) As an information in advance: The gnome interface gcdmaster which can be built with cdrdao needs the following packages stable for version cdrdao-1.2.0: >=dev-cpp/gconfmm-2.6 >=dev-cpp/libglademm-2.4 >=dev-cpp/gnome-vfsmm-2.6 >=dev-cpp/libgnomecanvasmm-2.6 >=dev-cpp/libgnomemm-2.6 >=dev-cpp/libgnomeuimm-2.6 These are all gnome-herd packages. Please ask if the packages are ready for stable usage. I'll add a testing masked version of cdrdao-1.2.0 as soon as it has been compiled on my machine.
Added gnome to CC like requested by foser - he will take a look when he has some time.
any news on this one?
foser/pylon any news on this one?
See my comment #6. I'm waiting for the gnome-herd masking some packages stable. Otherwise a newer cdrdao won't become stable.
These are all owned by the gnome-mm herd, adding to cc.
I'll work on the others, but pYrania maintains gnome-vfsmm.
>=dev-cpp/gconfmm-2.6 <- done >=dev-cpp/libglademm-2.4 <- done earlier this week >=dev-cpp/gnome-vfsmm-2.6 <- waiting on pYrania >=dev-cpp/libgnomecanvasmm-2.6 <- done by someone else at some point >=dev-cpp/libgnomemm-2.6 <- done >=dev-cpp/libgnomeuimm-2.6 <- waiting on gnome-vfsmm stable
>=dev-cpp/gnome-vfsmm-2.6 <- it's stable now on x86. Now we can get >=dev-cpp/libgnomeuimm-2.6 stable. ppc, ppc64 and sparc are already ready for the cdrdao-upgrade. There is no other open bug from it's testing phase. When all dependencies are done for x86, I'll mask cdrdao-1.2.0 stable.
dev-cpp/libgnomeuimm-2.6.0 stable on x86
cdrdao-1.2.0 stable on x86 and ppc. Other arches should test and upgrade to cdrdao-1.2.0.
Arches, please test and make stable cdrdao-1.2.0. Current keywords: cdrdao-1.2.0: ~amd64 ppc ~ppc64 ~sparc x86 Target keywords: cdrdao-1.2.0: alpha amd64 hppa ia64 ppc ppc64 sparc x86 I previously dropped the alpha, hppa and ia64 keyword for this version as it contains major changes.
stable on ppc64
Stable on amd64.
sparc stable.
LLoydBates reported a minor problem with the ebuild, it adds 1.1.9 as version, not 1.2.0: # Add gentoo to version sed -i -e "s:^PACKAGE_STRING='cdrdao 1.1.9':PACKAGE_STRING='cdrdao 1.1.9 gentoo':" configure Removing remaining arches until another ebuild comes so that they can spend their time for other bugs ;)
Fix done (and in a way, it should not happen again ;-) ). Remaining arches are alpha, hppa and ia64.
Alpha, ia64, hppa: please mark cdrdao-1.2.0 stable, thanks!
We (hppa) are working on marking stable this ebuild. But we need further testing because of major changes.
Now stable on hppa. Sorry for the delay.
cdrdao is p.masked in alpha until we can mark cdrdao-1.2.0 stable. Cheers Ferdy
I guess we can now close this one. Reopen if you disagree.
