CVE-2009-1894 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.2 UNKNOWN	LOCAL	LOW		AV:L/AC:L/Au:N/C:C/I:C/A:C
redhat	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 29%

Vendor	Product	Version
pulseaudio	pulseaudio	0.9.9
pulseaudio	pulseaudio	0.9.10
pulseaudio	pulseaudio	0.9.14

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

pulseaudio

bullseye	14.2-2 fixed
etch	not-affected
bookworm	16.1+dfsg1-2 fixed
sid	16.1+dfsg1-5.1 fixed
trixie	16.1+dfsg1-5.1 fixed

Ubuntu Releases

Ubuntu Product

Codename

pulseaudio

jaunty	Fixed 1:0.9.14-0ubuntu20.2 released
intrepid	Fixed 0.9.10-2ubuntu9.4 released
hardy	Fixed 0.9.10-1ubuntu1.1 released
dapper	dne

Known Exploits!

Common Weakness Enumeration

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References

http://blog.cr0.org/2009/07/old-school-local-root-vulnerability-in.html

http://secunia.com/advisories/35868

http://secunia.com/advisories/35886

http://secunia.com/advisories/35896

http://security.gentoo.org/glsa/glsa-200907-13.xml

http://taviso.decsystem.org/research.html

http://www.akitasecurity.nl/advisory.php?id=AK20090602

http://www.debian.org/security/2009/dsa-1838

http://www.mandriva.com/security/advisories?name=MDVSA-2009:152

http://www.mandriva.com/security/advisories?name=MDVSA-2009:171

http://www.securityfocus.com/archive/1/505052/100/0/threaded

http://www.securityfocus.com/bid/35721

http://www.ubuntu.com/usn/usn-804-1

https://admin.fedoraproject.org/updates/pulseaudio-0.9.10-1.el5.2

https://bugzilla.redhat.com/show_bug.cgi?id=510071

https://exchange.xforce.ibmcloud.com/vulnerabilities/51804

http://blog.cr0.org/2009/07/old-school-local-root-vulnerability-in.html

http://secunia.com/advisories/35868

http://secunia.com/advisories/35886

http://secunia.com/advisories/35896

http://security.gentoo.org/glsa/glsa-200907-13.xml

http://taviso.decsystem.org/research.html

http://www.akitasecurity.nl/advisory.php?id=AK20090602

http://www.debian.org/security/2009/dsa-1838

http://www.mandriva.com/security/advisories?name=MDVSA-2009:152

http://www.mandriva.com/security/advisories?name=MDVSA-2009:171

http://www.securityfocus.com/archive/1/505052/100/0/threaded

http://www.securityfocus.com/bid/35721

http://www.ubuntu.com/usn/usn-804-1

https://admin.fedoraproject.org/updates/pulseaudio-0.9.10-1.el5.2

https://bugzilla.redhat.com/show_bug.cgi?id=510071

https://exchange.xforce.ibmcloud.com/vulnerabilities/51804