PT-2006-7553 · Ppp · Pppd+1

Published 1970-01-01 · Updated 2020-02-24 · CVE-2006-2194

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ppp versions 2.4.4 and earlier

Description The issue concerns a problem with the winbind plugin in pppd, where it does not check the return code from the setuid function call. This might allow local users to gain privileges by causing setuid to fail. The exploitation of vulnerabilities in the ppp package may lead to a breach of confidentiality, integrity, and availability of protected information. A local attacker can exploit these vulnerabilities.

Recommendations For versions 2.4.4 and earlier, as a temporary workaround, consider restricting access to the setuid function call until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-02183

BDU:2015-02884

CVE-2006-2194

DSA-1106

Affected Products

Ppp

Pppd

References · 17

• http://ubuntu.com/usn/usn-310-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-2194 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-2194 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:119 · Vendor Advisory
• http://debian.org/security/2006/dsa-1106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2194 · Security Note
• https://bdu.fstec.ru/vul/2015-02884 · Security Note
• http://securityfocus.com/bid/18849 · Patch
• http://secunia.com/advisories/20996 · Vendor Advisory
• http://secunia.com/advisories/20967 · Vendor Advisory
• http://secunia.com/advisories/20987 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2194 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2006-2194 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02183 · Security Note
• http://debian.org/security/dsa-1106 · Note