CVE-2006-3084 — Heimdal vulnerability

CWE-2648 documents7 sources
Severity
7.2HIGHNVD
EPSS
0.5%
top 32.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
MIT Krb5HeimdalMIT Kerberos 5
Timeline
PublishedAug 9
Latest updateMay 3

Description

The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages3 packages

▶Debianmit/krb5< 1.4.3-9+3
▶NVDheimdal/heimdal0.7.2
▶NVDmit/kerberos_55 versions+4

🔴Vulnerability Details

3
GHSA
GHSA-863q-qjw4-fmrr: The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1↗2022-05-03
▶
CVEList
CVE-2006-3084: The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1↗2006-08-09
▶
OSV
CVE-2006-3084: The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1↗2006-08-09
▶

📋Vendor Advisories

2
Ubuntu
krb5 vulnerabilities↗2006-08-16
▶
Debian
CVE-2006-3084: krb5 - The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1....↗2006
▶

💬Community

2
Bugzilla
CVE-2006-3083 krb5 multiple unsafe setuid usage↗2006-08-15
▶
Bugzilla
CVE-2006-3083 krb5 multiple unsafe setuid usage↗2006-07-06
▶
CVE-2006-3084 — Heimdal vulnerability | cvebase