CVE-2004-0806: cdrecord in the cdrtools package before 2.01, when installed setuid root, does not properly drop privileges...

Security readout for executives and security teams

CVE-2004-0806 is a local privilege escalation in cdrecord from cdrtools before 2.01. If cdrecord is installed setuid root, a local user may abuse the RSH environment variable path to run code with elevated privileges. The issue matters mainly on legacy Unix/Linux systems that still expose setuid cdrecord. Exposure is most likely on old Linux or Unix installations with cdrtools cdrecord earlier than 2.01 and the cdrecord binary installed setuid root. Modern systems may be unaffected if they removed setuid behavior, updated packages, or no longer install cdrecord. Prioritize remediation where legacy shared systems still allow local users. This is not a remote internet-facing bug based on the supplied evidence, but successful exploitation could give root access and compromise the host. Mitigation focus: Upgrade cdrtools or cdrecord to version 2.01 or a vendor-patched package.; Remove setuid-root permission from cdrecord where operationally acceptable.; Restrict shell access on legacy multi-user systems until remediation is complete..

Prepared

Jun 30, 2026, 03:21 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.