Unscored severity · published Nov 21, 2006
CVE-2006-6008
ftpd in Linux Netkit (linux-ftpd) 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote…
–
CVSS
2.1%
EPSS
No
On KEV
Description
ftpd in Linux Netkit (linux-ftpd) 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different vulnerability than CVE-2006-5778.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netkit · Netkit
0.17 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-6008
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-6008
Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384454
Patch
http://bugs.gentoo.org/show_bug.cgi?id=150292
Patch
http://ftp.debian.org/debian/pool/main/l/linux-ftpd/linux-ftpd_0.17-22.diff.gz
Patch
http://secunia.com/advisories/22816
Patch
http://secunia.com/advisories/22853
Patch
http://www.gentoo.org/security/en/glsa/glsa-200611-05.xml
More from Netkit
9.8
CVE-2023-38336
netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778
7.4
CVE-2019-7283
An issue was discovered in rcp in NetKit through 0.17
5.9
CVE-2019-7282
In NetKit through 0.17, rcp.c in the rcp client allows remote rsh servers to bypass intended access restrictions via the filename of