CVE-2006-3084

2006-08-0910:04:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2006-3084

mit kerberos

heimdal

vulnerability

setuid

privilege escalation

security issue

6.3 Medium

AI Score

Confidence

Low

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

14.3%

JSON

The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.

CPENameOperatorVersion
heimdal:heimdalheimdalle0.7.2
mit:kerberos_5mit kerberos 5eq1.4
mit:kerberos_5mit kerberos 5eq1.4.1
mit:kerberos_5mit kerberos 5eq1.4.2
mit:kerberos_5mit kerberos 5eq1.4.3
mit:kerberos_5mit kerberos 5eq1.5

CPE	Name	Operator	Version
heimdal:heimdal	heimdal	le	0.7.2
mit:kerberos_5	mit kerberos 5	eq	1.4
mit:kerberos_5	mit kerberos 5	eq	1.4.1
mit:kerberos_5	mit kerberos 5	eq	1.4.2
mit:kerberos_5	mit kerberos 5	eq	1.4.3
mit:kerberos_5	mit kerberos 5	eq	1.5