Debian Security Advisory

DSA-681-1 synaesthesia -- privilege escalation

Date Reported:

14 Feb 2005

Affected Packages:

synaesthesia

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2005-0070.

More information:

Erik Sjölund and Devin Carraway discovered that synaesthesia, a program for representing sounds visually, accesses user-controlled configuration and mixer files with elevated privileges. Thus, it is possible to read arbitrary files.

For the stable distribution (woody) this problem has been fixed in version 2.1-2.1woody3.

For the testing (sarge) and unstable (sid) distribution this problem does not exist since synaesthesia is not installed setuid root anymore.

We recommend that you upgrade your synaesthesia package.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Source:: http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3.dsc; http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3.diff.gz; http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1.orig.tar.gz
Alpha:: http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3_ia64.deb
HPPA:: http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3_hppa.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3_m68k.deb
Big endian MIPS:: http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3_mips.deb
Little endian MIPS:: http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/s/synaesthesia/synaesthesia_2.1-2.1woody3_sparc.deb

MD5 checksums of the listed files are available in the original advisory.