Unscored severity · published Aug 9, 2006
CVE-2006-3083
The (1) krshd and (2) v4rcp applications in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and (b) Heimdal 0.7.2 and earlier, do not…
–
CVSS
0.5%
EPSS
No
On KEV
Description
The (1) krshd and (2) v4rcp applications in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges using attacks such as resource exhaustion.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
Heimdal · Heimdal
0.7.2 · source: NVD
K5
Kerberos 5 · Mit
1.4; 1.4.1; 1.4.2; 1.4.3; 1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3083
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3083
Vendor Advisory
http://secunia.com/advisories/21402
Vendor Advisory
http://secunia.com/advisories/21423
Vendor Advisory
http://secunia.com/advisories/21436
Vendor Advisory
http://secunia.com/advisories/21439
Vendor Advisory
http://secunia.com/advisories/21441
More from Heimdal
–
CVE-2007-5939
The gss_userok function in appl/ftp/ftpd/gss_userok.c in Heimdal 0.7.2 does not allocate memory for the ticketfile pointer before calling free, which allows remote attackers to…
–
CVE-2006-3084
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls,…