CVE-2006-1174

Published: May 28, 2006Modified: Apr 16, 2026

3.7

Vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Exploitability: 1.9 / Impact: 6.4

Source: NVD

Description

useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.

Affected (8)

Products: Debian: Shadow

Debian

1 product

Shadow

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Debian Shadow	Up to 4.0.7
Debian Shadow	Version 4.0.0
Debian Shadow	Version 4.0.1
Debian Shadow	Version 4.0.2
Debian Shadow	Version 4.0.4.1
Debian Shadow	Version 4.0.4
Debian Shadow	Version 4.0.5
Debian Shadow	Version 4.0.6

Related CWEs

CWE-264

References (52)

ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc (unsafe URL)

Source: cret@cert.org

http://cvs.pld.org.pl/shadow/NEWS?rev=1.109

Source: cret@cert.org

http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html

Source: cret@cert.org

http://secunia.com/advisories/20370

Source: cret@cert.org

PatchVendor Advisory

http://secunia.com/advisories/20506

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/25098

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/25267

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/25629

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/25894

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/25896

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/26909

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/27706

Source: cret@cert.org

Vendor Advisory

http://support.avaya.com/elmodocs2/security/ASA-2007-249.htm

Source: cret@cert.org

http://www.gentoo.org/security/en/glsa/glsa-200606-02.xml

Source: cret@cert.org

http://www.kb.cert.org/vuls/id/312692

Source: cret@cert.org

US Government Resource

http://www.mandriva.com/security/advisories?name=MDKSA-2006:090

Source: cret@cert.org

http://www.redhat.com/support/errata/RHSA-2007-0276.html

Source: cret@cert.org

http://www.redhat.com/support/errata/RHSA-2007-0431.html

Source: cret@cert.org

http://www.securityfocus.com/archive/1/468336/100/0/threaded

Source: cret@cert.org

http://www.securityfocus.com/bid/18111

Source: cret@cert.org

Patch

http://www.securitytracker.com/id?1018221

Source: cret@cert.org

http://www.vupen.com/english/advisories/2006/2006

Source: cret@cert.org

Vendor Advisory

http://www.vupen.com/english/advisories/2007/3229

Source: cret@cert.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/26958

Source: cret@cert.org

https://issues.rpath.com/browse/RPL-1357

Source: cret@cert.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10807

Source: cret@cert.org

ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc (unsafe URL)