CVE-2004-0806: Cdrtools Cdrecord

High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days.

cdrecord in the cdrtools package before 2.01, when installed setuid root, does not properly drop privileges before executing a program specified in the RSH environment variable, which allows local users to gain privileges.

Affected products

• Cdrtools Cdrecord: version 1.11 only; version 2.0 only

Published 2004-12-31. Last modified 2026-06-16.