PT-2006-1059 · Heimdal+2 · Heimdal+2

Marcus Meissner + 1 · Published 2006-08-08 · Updated 2020-01-21 · CVE-2006-3083

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: MIT Kerberos 5 (krb5) versions 1.4.x before 1.4.4 MIT Kerberos 5 (krb5) versions up to 1.5 Heimdal versions up to 0.7.2 mit-krb5 versions prior to 1.4.3-r3

Description: The issue is related to the krshd and v4rcp applications in MIT Kerberos 5 and Heimdal, which do not check return codes for setuid calls. This allows local users to gain privileges by causing setuid to fail to drop privileges using attacks such as resource exhaustion. The vulnerability can lead to disruption of confidentiality, integrity, and availability of protected information and can be exploited locally.

Recommendations: For MIT Kerberos 5 (krb5) versions up to 1.5, update to a version later than 1.5. For MIT Kerberos 5 (krb5) versions 1.4.x before 1.4.4, update to version 1.4.4 or later. For Heimdal versions up to 0.7.2, update to a version later than 0.7.2. For mit-krb5 versions prior to 1.4.3-r3, update to version 1.4.3-r3 or later.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-09518

CVE-2006-3083

DSA-1146-1

RHSA-2006:0612

RHSA-2006_0612

Affected Products

Heimdal

Mit Kerberos 5

Red Hat

References · 41

• http://security.gentoo.org/glsa/glsa-200608-21.xml · Vendor Advisory
• http://secunia.com/advisories/21613 · Vendor Advisory
• http://debian.org/security/2006/dsa-1146 · Vendor Advisory
• http://secunia.com/advisories/21436 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-3083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3083 · Security Note
• http://secunia.com/advisories/21423 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200608-15.xml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-3083 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_22_sr.html · Vendor Advisory
• http://secunia.com/advisories/21402 · Vendor Advisory
• http://secunia.com/advisories/21456 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0612.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:139 · Vendor Advisory
• http://secunia.com/advisories/21461 · Vendor Advisory