PT-2006-7553 · Ppp · Pppd+1

Publicado 1970-01-01 · Atualizado 2020-02-24 · CVE-2006-2194

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ppp versions 2.4.4 and earlier

Description The issue concerns a problem with the winbind plugin in pppd, where it does not check the return code from the setuid function call. This might allow local users to gain privileges by causing setuid to fail. The exploitation of vulnerabilities in the ppp package may lead to a breach of confidentiality, integrity, and availability of protected information. A local attacker can exploit these vulnerabilities.

Recommendations For versions 2.4.4 and earlier, as a temporary workaround, consider restricting access to the setuid function call until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

BDU:2015-02183

BDU:2015-02884

CVE-2006-2194

DSA-1106

Produtos afetados

Ppp

Pppd

Referências · 17

• http://ubuntu.com/usn/usn-310-1 · Aviso do Fabricante
• http://debian.org/security/dsa-1106 · Nota
• https://osv.dev/vulnerability/CVE-2006-2194 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-2194 · Aviso do Fabricante
• http://secunia.com/advisories/20963 · Nota
• http://osvdb.org/26994 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2006:119 · Aviso do Fabricante
• http://debian.org/security/2006/dsa-1106 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-2194 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-02884 · Nota de Segurança
• http://securityfocus.com/bid/18849 · Correção
• http://secunia.com/advisories/20996 · Aviso do Fabricante
• http://secunia.com/advisories/20967 · Aviso do Fabricante
• http://secunia.com/advisories/20987 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2194 · Nota de Segurança