CVE-2006-3084: High severity heimdal heimdal vulnerability
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3084?
CVE-2006-3084 has medium severity due to the potential for local privilege escalation.
How do I fix CVE-2006-3084?
To fix CVE-2006-3084, update to a secure version of MIT Kerberos 5 or Heimdal that addresses the setuid return code check issue.
Which versions are affected by CVE-2006-3084?
CVE-2006-3084 affects MIT Kerberos 5 versions up to 1.5 and Heimdal versions up to 0.7.2.
What programs are associated with CVE-2006-3084?
The programs associated with CVE-2006-3084 are ftpd and ksu.
Can CVE-2006-3084 be exploited remotely?
CVE-2006-3084 is a local vulnerability, meaning it requires local user access to exploit.