PT-2006-2835 · Debian · Base-Config+1

Joey Hess · Published 2006-04-19 · Updated 2020-08-11 · CVE-2006-1844

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Debian installer for shadow version 4.0.14 Debian installer for base-config version 2.53.10

Description The issue concerns sensitive information being included in world-readable log files by the Debian installer. This information includes preseeded passwords and pppoeconf passwords, which could potentially allow local users to gain privileges.

Recommendations For shadow version 4.0.14, restrict access to the log files generated by the Debian installer to prevent unauthorized users from reading sensitive information. For base-config version 2.53.10, consider modifying the installer to exclude sensitive information from log files or apply appropriate permissions to limit access to these logs.

Fix

Related Identifiers

CVE-2006-1844

Affected Products

Debian

Base-Config

References · 7

• https://security-tracker.debian.org/tracker/CVE-2006-1844 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-1844 · Vendor Advisory
• http://secunia.com/advisories/19170 · Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356939 · Patch
• http://osvdb.org/23922 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-1844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1844 · Security Note