CVEvulnerability
CVE-2006-3083
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2006-08-09
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-399
Description
The (1) krshd and (2) v4rcp applications in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges using attacks such as resource exhaustion.
Affected configurations
• heimdal heimdal 0.7.2
• mit kerberos 5 1.4
• mit kerberos 5 1.4.1
• mit kerberos 5 1.4.2
• mit kerberos 5 1.4.3
• mit kerberos 5 1.5
Related
Weakness · not in database (1)
References
- ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt ftp.pdc.kth.se
- http://secunia.com/advisories/21402 Vendor Advisory
- http://secunia.com/advisories/21423 Vendor Advisory
- http://secunia.com/advisories/21436 Vendor Advisory
- http://secunia.com/advisories/21439 Vendor Advisory
- http://secunia.com/advisories/21441 Vendor Advisory
- http://secunia.com/advisories/21456 Vendor Advisory
- http://secunia.com/advisories/21461 Vendor Advisory
- http://secunia.com/advisories/21467 Vendor Advisory
- http://secunia.com/advisories/21527 Vendor Advisory
- http://secunia.com/advisories/21613 Vendor Advisory
- http://secunia.com/advisories/21847 Vendor Advisory
- http://secunia.com/advisories/22291 Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200608-21.xml security.gentoo.org
- http://securitytracker.com/id?1016664 securitytracker.com
- http://support.avaya.com/elmodocs2/security/ASA-2006-211.htm support.avaya.com
- http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txt Patch, Vendor Advisory
- http://www.debian.org/security/2006/dsa-1146 www.debian.org
- http://www.gentoo.org/security/en/glsa/glsa-200608-15.xml www.gentoo.org
- http://www.kb.cert.org/vuls/id/580124 Patch, US Government Resource
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:139 www.mandriva.com
- http://www.novell.com/linux/security/advisories/2006_20_sr.html www.novell.com
- http://www.novell.com/linux/security/advisories/2006_22_sr.html www.novell.com
- http://www.osvdb.org/27869 www.osvdb.org
- http://www.osvdb.org/27870 www.osvdb.org
- http://www.pdc.kth.se/heimdal/advisory/2006-08-08/ www.pdc.kth.se
- http://www.redhat.com/support/errata/RHSA-2006-0612.html Patch, Vendor Advisory
- http://www.securityfocus.com/archive/1/442599/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/443498/100/100/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/19427 www.securityfocus.com
- http://www.ubuntu.com/usn/usn-334-1 www.ubuntu.com
- http://www.vupen.com/english/advisories/2006/3225 Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9515 oval.cisecurity.org
- ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt ftp.pdc.kth.se
- http://secunia.com/advisories/21402 Vendor Advisory
- http://secunia.com/advisories/21423 Vendor Advisory
- http://secunia.com/advisories/21436 Vendor Advisory
- http://secunia.com/advisories/21439 Vendor Advisory
- http://secunia.com/advisories/21441 Vendor Advisory
- http://secunia.com/advisories/21456 Vendor Advisory
- http://secunia.com/advisories/21461 Vendor Advisory
- http://secunia.com/advisories/21467 Vendor Advisory
- http://secunia.com/advisories/21527 Vendor Advisory
- http://secunia.com/advisories/21613 Vendor Advisory
- http://secunia.com/advisories/21847 Vendor Advisory
- http://secunia.com/advisories/22291 Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200608-21.xml security.gentoo.org
- http://securitytracker.com/id?1016664 securitytracker.com
- http://support.avaya.com/elmodocs2/security/ASA-2006-211.htm support.avaya.com
- http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txt Patch, Vendor Advisory
- http://www.debian.org/security/2006/dsa-1146 www.debian.org
- http://www.gentoo.org/security/en/glsa/glsa-200608-15.xml www.gentoo.org
- http://www.kb.cert.org/vuls/id/580124 Patch, US Government Resource
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:139 www.mandriva.com
- http://www.novell.com/linux/security/advisories/2006_20_sr.html www.novell.com
- http://www.novell.com/linux/security/advisories/2006_22_sr.html www.novell.com
- http://www.osvdb.org/27869 www.osvdb.org
- http://www.osvdb.org/27870 www.osvdb.org
- http://www.pdc.kth.se/heimdal/advisory/2006-08-08/ www.pdc.kth.se
- http://www.redhat.com/support/errata/RHSA-2006-0612.html Patch, Vendor Advisory
- http://www.securityfocus.com/archive/1/442599/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/443498/100/100/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/19427 www.securityfocus.com
- http://www.ubuntu.com/usn/usn-334-1 www.ubuntu.com
- http://www.vupen.com/english/advisories/2006/3225 Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9515 oval.cisecurity.org