CVE-2008-0008 - CVE House
Back to Database
Status published High CVE-2008-0008

The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9...

Vulnerability Description

The pa_drop_root function in PulseAudio 0.9.8, and a certain 0.9.9 build, does not check return values from (1) setresuid, (2) setreuid, (3) setuid, and (4) seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail via attacks such as resource exhaustion.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2008-0008

Credits & Attribution

No credits recorded in the NVD database.

References

More from pulseaudio

View All →
CVE-2014-3970
The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in...
Low 2.9
CVE-2009-1894
Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local...
High 7.2
CVE-2009-1299
The pa_make_secure_dir function in core-util.c in PulseAudio 0.9.10 and 0.9.19...
Medium 6.9
CVE-2007-1804
PulseAudio 0.9.5 allows remote attackers to cause a denial of...
High 7.8

Affected Vendor

Affected Software

pulseaudio
Vulnerable Versions:
0.9.6, 0.9.8

Timeline

Official Publish: January 28th, 2008
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.