PT-2006-1060 · Heimdal+1 · Heimdal+1
Marcus Meissner
+1
·
Published
2006-08-09
·
Updated
2020-01-21
·
CVE-2006-3084
CVSS v2.0
7.2
High
| Vector | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
MIT Kerberos 5 (krb5) versions 1.4.x before 1.4.4
MIT Kerberos 5 (krb5) versions up to 1.5
Heimdal versions 0.7.2 and earlier
mit-krb5 versions prior to 1.4.3-r3
Description:
The issue is related to the ftpd and ksu programs in MIT Kerberos 5 (krb5) and Heimdal, which do not check return codes for setuid calls. This might allow local users to gain privileges by causing setuid to fail to drop privileges. The exploitation of these vulnerabilities may lead to a violation of confidentiality, integrity, and availability of protected information. It is noted that as of the given date, it is not known whether an exploitable attack scenario exists for these issues. The vulnerabilities can be exploited locally.
Recommendations:
For MIT Kerberos 5 (krb5) versions up to 1.5, update to a version later than 1.5.
For MIT Kerberos 5 (krb5) versions 1.4.x before 1.4.4, update to version 1.4.4 or later.
For Heimdal versions 0.7.2 and earlier, update to a version later than 0.7.2.
For mit-krb5 versions prior to 1.4.3-r3, update to version 1.4.3-r3 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Heimdal
Mit Kerberos 5