CVE Vulnerabilities

CVE-2006-3083

Published: Aug 09, 2006 | Modified: Jan 21, 2020
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.2 HIGH
AV:L/AC:L/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu

The (1) krshd and (2) v4rcp applications in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges using attacks such as resource exhaustion.

Affected Software

Name Vendor Start Version End Version
Heimdal Heimdal 0.7.2 0.7.2
Kerberos_5 Mit 1.4 1.4
Kerberos_5 Mit 1.4.1 1.4.1
Kerberos_5 Mit 1.4.2 1.4.2
Kerberos_5 Mit 1.4.3 1.4.3
Kerberos_5 Mit 1.5 1.5

References