Unscored severity · published Apr 25, 2006
CVE-2006-1057
Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority…
–
CVSS
0.3%
EPSS
No
On KEV
Description
Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a symlink attack when gdm performs chown and chgrp operations on the .ICEauthority file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GD
Gdm · Gnome
2.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-1057
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-1057
cvs.gnome.org
http://cvs.gnome.org/viewcvs/gdm2/daemon/slave.c?r1=1.260&r2=1.261
Patch
http://www.debian.org/security/2006/dsa-1040
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDKSA-2006:083
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2007-0286.html
www.securityfocus.com
http://www.securityfocus.com/bid/17635
Vendor Advisory
http://www.vupen.com/english/advisories/2006/1465
More from Gdm
–
CVE-2011-1709
GNOME Display Manager (gdm) before 2.32.2, when glib 2.28 is used, enables execution of a web browser with the uid of the gdm account, which allows local users to gain privileges…
–
CVE-2011-0727
GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files via a symlink attack on a (1) dmrc or (2) face icon file under…
–
CVE-2009-2697
The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to…
–
CVE-2007-3381
The GDM daemon in GNOME Display Manager (GDM) before 2.14.13, 2.16.x before 2.16.7, 2.18.x before 2.18.4, and 2.19.x before 2.19.5 does not properly handle NULL return values from…
–
CVE-2006-6105
Format string vulnerability in the host chooser window (gdmchooser) in GNOME Foundation Display Manager (gdm) allows local users to execute arbitrary code via format string…