Unrated severityNVD Advisory· Published Aug 9, 2006· Updated Apr 16, 2026
CVE-2006-3084
CVE-2006-3084
Description
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.
Affected products
6cpe:2.3:a:mit:kerberos_5:1.4:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:mit:kerberos_5:1.4:*:*:*:*:*:*:*
- cpe:2.3:a:mit:kerberos_5:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:mit:kerberos_5:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:mit:kerberos_5:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:mit:kerberos_5:1.5:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
25- secunia.com/advisories/21402nvdVendor Advisory
- secunia.com/advisories/21436nvdVendor Advisory
- secunia.com/advisories/21439nvdVendor Advisory
- secunia.com/advisories/21461nvdVendor Advisory
- secunia.com/advisories/21467nvdVendor Advisory
- secunia.com/advisories/21527nvdVendor Advisory
- secunia.com/advisories/21613nvdVendor Advisory
- secunia.com/advisories/23707nvdVendor Advisory
- www.vupen.com/english/advisories/2006/3225nvdVendor Advisory
- www.kb.cert.org/vuls/id/401660nvdUS Government Resource
- ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txtnvd
- fedoranews.org/cms/node/2376nvd
- security.gentoo.org/glsa/glsa-200608-21.xmlnvd
- securitytracker.com/idnvd
- web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txtnvd
- www.debian.org/security/2006/dsa-1146nvd
- www.gentoo.org/security/en/glsa/glsa-200608-15.xmlnvd
- www.novell.com/linux/security/advisories/2006_20_sr.htmlnvd
- www.osvdb.org/27871nvd
- www.osvdb.org/27872nvd
- www.pdc.kth.se/heimdal/advisory/2006-08-08/nvd
- www.securityfocus.com/archive/1/442599/100/0/threadednvd
- www.securityfocus.com/archive/1/443498/100/100/threadednvd
- www.securityfocus.com/bid/19427nvd
- www.ubuntu.com/usn/usn-334-1nvd
News mentions
0No linked articles in our index yet.