Exploitation Summary
EIP tracks 2 public exploits for CVE-2004-0806. PoCs published by Max Vozeler, I)ruid.
AI-analyzed exploit summary This exploit leverages a local privilege escalation vulnerability in cdrecord's readcd utility by manipulating the RSH environment variable to execute arbitrary code as root. It compiles two C programs to set SUID permissions on a shell and then triggers the vulnerability via the readcd command.
Description
cdrecord in the cdrtools package before 2.01, when installed setuid root, does not properly drop privileges before executing a program specified in the RSH environment variable, which allows local users to gain privileges.
Exploits (2)
This exploit leverages a local privilege escalation vulnerability in cdrecord's readcd utility by manipulating the RSH environment variable to execute arbitrary code as root. It compiles two C programs to set SUID permissions on a shell and then triggers the vulnerability via the readcd command.
This exploit leverages a vulnerability in cdrecord where it executes the $RSH environment variable before dropping privileges. It creates a SUID bash shell by exploiting the insecure execution path.