PT-2006-7284 · Chet · Chetcpasswd

Stefan Fritsch · Published 2006-12-21 · Updated 2019-11-13 · CVE-2006-6683

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: chetcpasswd versions 2.4.1 and earlier

Description: The issue allows remote attackers to bypass intended restrictions implemented through PAM, as the custom code used to verify and update user accounts does not follow the PAM configuration. This is due to the custom code processing /etc/shadow.

Recommendations: For versions 2.4.1 and earlier, consider modifying the custom code to adhere to the PAM configuration to prevent bypassing of intended restrictions. As a temporary workaround, restrict access to the /etc/shadow file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-6683

Affected Products

Chetcpasswd

References · 3

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6683 · Security Note
• http://securityfocus.com/bid/21102 · Vendor Advisory