Test ID:	1.3.6.1.4.1.25623.1.0.50719
Category:	Mandrake Local Security Checks
Title:	Mandrake Security Advisory MDKSA-2003:058-1 (cdrecord)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to cdrecord announced via advisory MDKSA-2003:058-1. A vulnerability in cdrecord was discovered that can be used to obtain root access because Mandrake Linux ships with the cdrecord binary suid root and sgid cdwriter. Updated packages are provided that fix this vulnerability. You may also elect to remove the suid and sgid bits from cdrecord manually, which can be done by executing, as root: chmod ug-s /usr/bin/cdrecord This is not required to protect yourself from this particular vulnerability, however. Update: Two additional format string problems were discovered by Olaf Kirch and an updated patch has been applied to fix those problems as well. Affected versions: 8.2, 9.0, 9.1, Corporate Server 2.1 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2003:058-1 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0289 http://marc.theaimsgroup.com/?l=bugtraq&m=105285564307225&w=2 Risk factor : High CVSS Score: 7.2
Cross-Ref:	BugTraq ID: 7565 Common Vulnerability Exposure (CVE) ID: CVE-2003-0289 http://www.securityfocus.com/bid/7565 Bugtraq: 20030513 Cdrecord_local_root_exploit. (Google Search) http://marc.info/?l=bugtraq&m=105286031812533&w=2 Bugtraq: 20030513 cdrtools2.0 Format String Vulnerability (Google Search) http://marc.info/?l=bugtraq&m=105285564307225&w=2 http://forums.gentoo.org/viewtopic.php?t=54904 http://www.mandriva.com/security/advisories?name=MDKSA-2003:058 http://www.securiteam.com/exploits/5ZP0C2AAAC.html XForce ISS Database: cdrtools-scsiopen-format-string(12007) https://exchange.xforce.ibmcloud.com/vulnerabilities/12007
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.