cdrecord in the cdrtools package before 2.01, when installed setuid root, does not properly drop privileges before executing a program specified in the RSH environment variable, which allows local users to gain privileges.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Cdrecord | Cdrtools | 1.11 (including) | 1.11 (including) |
Cdrecord | Cdrtools | 2.0 (including) | 2.0 (including) |