PT-2006-7284 · Chet · Chetcpasswd

Stefan Fritsch · Publicado 2006-12-21 · Atualizado 2019-11-13 · CVE-2006-6683

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: chetcpasswd versions 2.4.1 and earlier

Description: The issue allows remote attackers to bypass intended restrictions implemented through PAM, as the custom code used to verify and update user accounts does not follow the PAM configuration. This is due to the custom code processing /etc/shadow.

Recommendations: For versions 2.4.1 and earlier, consider modifying the custom code to adhere to the PAM configuration to prevent bypassing of intended restrictions. As a temporary workaround, restrict access to the /etc/shadow file to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2006-6683

Produtos afetados

Chetcpasswd

Referências · 3

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-6683 · Nota de Segurança
• http://securityfocus.com/bid/21102 · Aviso do Fabricante