CVEvulnerability
CVE-2006-3084
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2006-08-09
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-264
Description
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.
Affected configurations
• heimdal heimdal (<= 0.7.2)
• mit kerberos 5 1.4
• mit kerberos 5 1.4.1
• mit kerberos 5 1.4.2
• mit kerberos 5 1.4.3
• mit kerberos 5 1.5
Related
Weakness · not in database (1)
References
- ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt ftp.pdc.kth.se
- http://fedoranews.org/cms/node/2376 fedoranews.org
- http://secunia.com/advisories/21402 Vendor Advisory
- http://secunia.com/advisories/21436 Vendor Advisory
- http://secunia.com/advisories/21439 Vendor Advisory
- http://secunia.com/advisories/21461 Vendor Advisory
- http://secunia.com/advisories/21467 Vendor Advisory
- http://secunia.com/advisories/21527 Vendor Advisory
- http://secunia.com/advisories/21613 Vendor Advisory
- http://secunia.com/advisories/23707 Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200608-21.xml security.gentoo.org
- http://securitytracker.com/id?1016664 securitytracker.com
- http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txt web.mit.edu
- http://www.debian.org/security/2006/dsa-1146 www.debian.org
- http://www.gentoo.org/security/en/glsa/glsa-200608-15.xml www.gentoo.org
- http://www.kb.cert.org/vuls/id/401660 US Government Resource
- http://www.novell.com/linux/security/advisories/2006_20_sr.html www.novell.com
- http://www.osvdb.org/27871 www.osvdb.org
- http://www.osvdb.org/27872 www.osvdb.org
- http://www.pdc.kth.se/heimdal/advisory/2006-08-08/ www.pdc.kth.se
- http://www.securityfocus.com/archive/1/442599/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/443498/100/100/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/19427 www.securityfocus.com
- http://www.ubuntu.com/usn/usn-334-1 www.ubuntu.com
- http://www.vupen.com/english/advisories/2006/3225 Vendor Advisory
- ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt ftp.pdc.kth.se
- http://fedoranews.org/cms/node/2376 fedoranews.org
- http://secunia.com/advisories/21402 Vendor Advisory
- http://secunia.com/advisories/21436 Vendor Advisory
- http://secunia.com/advisories/21439 Vendor Advisory
- http://secunia.com/advisories/21461 Vendor Advisory
- http://secunia.com/advisories/21467 Vendor Advisory
- http://secunia.com/advisories/21527 Vendor Advisory
- http://secunia.com/advisories/21613 Vendor Advisory
- http://secunia.com/advisories/23707 Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200608-21.xml security.gentoo.org
- http://securitytracker.com/id?1016664 securitytracker.com
- http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txt web.mit.edu
- http://www.debian.org/security/2006/dsa-1146 www.debian.org
- http://www.gentoo.org/security/en/glsa/glsa-200608-15.xml www.gentoo.org
- http://www.kb.cert.org/vuls/id/401660 US Government Resource
- http://www.novell.com/linux/security/advisories/2006_20_sr.html www.novell.com
- http://www.osvdb.org/27871 www.osvdb.org
- http://www.osvdb.org/27872 www.osvdb.org
- http://www.pdc.kth.se/heimdal/advisory/2006-08-08/ www.pdc.kth.se
- http://www.securityfocus.com/archive/1/442599/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/443498/100/100/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/19427 www.securityfocus.com
- http://www.ubuntu.com/usn/usn-334-1 www.ubuntu.com
- http://www.vupen.com/english/advisories/2006/3225 Vendor Advisory