Summary
The remote host is missing an update to synaesthesia announced via advisory DSA 681-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20681-1
Insight
Erik Sjölund and Devin Carraway discovered that synaesthesia, a program for representing sounds visually, accesses user-controlled configuration and mixer files with elevated privileges. Thus, it is possible to read arbitrary files.
For the stable distribution (woody) this problem has been fixed in version 2.1-2.1woody3.
For the testing (sarge) and unstable (sid) distribution this problem does not exist since synaesthesia is not installed setuid root anymore.
We recommend that you upgrade your synaesthesia package.
Severity
Classification
-
CVE CVE-2005-0070 -
CVSS Base Score: 7.2
AV:L/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities