PT-2006-2200 · Canonical · Ubuntu

Karl Øie + 1 · Published 2006-03-13 · Updated 2018-10-03 · CVE-2006-1183

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ubuntu version 5.10

Description The issue concerns the Ubuntu 5.10 installer, which fails to properly clear passwords from the installer log file, specifically questions.dat. This file is left with world-readable permissions, allowing local users to potentially gain privileges.

Recommendations For Ubuntu version 5.10, consider restricting access to the questions.dat log file to prevent unauthorized users from reading its contents. As a temporary workaround, manually remove or secure the questions.dat file after installation to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-1183

Affected Products

Ubuntu

References · 10

• 🔥 https://launchpad.net/distros/ubuntu/+source/shadow/+bug/34606 · Exploit
• 🔥 https://exploit-db.com/exploits/1579 · Exploit
• https://usn.ubuntu.com/262-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1183 · Security Note
• http://osvdb.org/23868 · Note
• http://vupen.com/english/advisories/2006/0927 · Note
• http://securityfocus.com/bid/17086 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25170 · Note
• http://secunia.com/advisories/19200 · Note
• http://securitytracker.com/id?1015761 · Note