CVE-2006-3084

Published: Aug 9, 2006Modified: Apr 16, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.

Affected (6)

Products: Heimdal: Heimdal · Mit: Kerberos 5

1 product

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Heimdal Heimdal	Up to 0.7.2
Mit Kerberos 5	Version 1.4.1
Mit Kerberos 5	Version 1.4.2
Mit Kerberos 5	Version 1.4.3
Mit Kerberos 5	Version 1.4
Mit Kerberos 5	Version 1.5

Related CWEs

CWE-264

References (50)

ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt (unsafe URL)

Source: cve@mitre.org

http://fedoranews.org/cms/node/2376

Source: cve@mitre.org

http://secunia.com/advisories/21402

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21436

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21439

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21461

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21467

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21527

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21613

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23707

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200608-21.xml

Source: cve@mitre.org

http://securitytracker.com/id?1016664

Source: cve@mitre.org

http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txt

Source: cve@mitre.org

http://www.debian.org/security/2006/dsa-1146

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200608-15.xml

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/401660

Source: cve@mitre.org

US Government Resource

http://www.novell.com/linux/security/advisories/2006_20_sr.html

Source: cve@mitre.org

http://www.osvdb.org/27871

Source: cve@mitre.org

http://www.osvdb.org/27872

Source: cve@mitre.org

http://www.pdc.kth.se/heimdal/advisory/2006-08-08/

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/442599/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/443498/100/100/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/19427

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-334-1

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/3225

Source: cve@mitre.org

Vendor Advisory

ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt (unsafe URL)