PT-2006-7281 · Chetcpasswd · Chetcpasswd

Published 2006-12-21 · Updated 2008-09-05 · CVE-2006-6680

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: chetcpasswd versions prior to 2.3.1

Description: The issue concerns a lack of documentation regarding the need for specific permissions on the /etc/chetcpasswd.allow file. This oversight might allow local users to obtain sensitive information by reading this file, as the required 0400 permissions are not clearly stated.

Recommendations: For versions prior to 2.3.1, ensure the /etc/chetcpasswd.allow file has 0400 permissions to prevent unauthorized access.

Fix

Related Identifiers

CVE-2006-6680

Affected Products

Chetcpasswd

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2006-6680 · Security Note
• http://sourceforge.net/project/shownotes.php?group_id=68912&release_id=466649 · Patch