Unscored severity · published Aug 9, 2006
CVE-2006-3084
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls,…
–
CVSS
0.5%
EPSS
No
On KEV
Description
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
Heimdal · Heimdal
through 0.7.2 · source: NVD
K5
Kerberos 5 · Mit
1.4; 1.4.1; 1.4.2; 1.4.3; 1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3084
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3084
fedoranews.org
http://fedoranews.org/cms/node/2376
Vendor Advisory
http://secunia.com/advisories/21402
Vendor Advisory
http://secunia.com/advisories/21436
Vendor Advisory
http://secunia.com/advisories/21439
Vendor Advisory
http://secunia.com/advisories/21461
More from Heimdal
–
CVE-2007-5939
The gss_userok function in appl/ftp/ftpd/gss_userok.c in Heimdal 0.7.2 does not allocate memory for the ticketfile pointer before calling free, which allows remote attackers to…
–
CVE-2006-3083
The (1) krshd and (2) v4rcp applications in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and (b) Heimdal 0.7.2 and earlier, do not…