CVE-2006-3084

Published Aug 9, 2006 CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Description
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-1146-1 New krb5 packages fix privilege escalation
EUVD EUVD EUVD-2006-3081 The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.
Ubuntu USN Ubuntu USN USN-334-1 krb5 vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 7, 2024, 6:16 PM
Reserved
Jun 19, 2006, 12:00 AM
Status
Modified
Published
Aug 9, 2006, 10:04 AM
Modified
Jun 16, 2026, 10:26 PM