{"api_version":"1","generated_at":"2026-07-23T11:09:30+00:00","cve":"CVE-2006-3084","urls":{"html":"https://cve.report/CVE-2006-3084","api":"https://cve.report/api/cve/CVE-2006-3084.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-3084","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-3084"},"summary":{"title":"CVE-2006-3084","description":"The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges.  NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2006-08-09 10:04:00","updated_at":"2020-01-21 15:45:00"},"problem_types":["CWE-264"],"metrics":[],"references":[{"url":"http://fedoranews.org/cms/node/2376","name":"FEDORA-2007-034","refsource":"FEDORA","tags":[],"title":"404 Not Found","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"http://securitytracker.com/id?1016664","name":"1016664","refsource":"SECTRACK","tags":[],"title":"SecurityTracker.com Archives - Kerberos Application Flaws in Evaluating setuid/seteuid Calls May Let Local Users Gain Elevated Privileges","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/27872","name":"27872","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.novell.com/linux/security/advisories/2006_20_sr.html","name":"SUSE-SR:2006:020","refsource":"SUSE","tags":[],"title":"Security Announcement","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200608-15.xml","name":"GLSA-200608-15","refsource":"GENTOO","tags":[],"title":"Gentoo Linux Documentation\n--\n  MIT Kerberos 5: Multiple local privilege escalation vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.pdc.kth.se/heimdal/advisory/2006-08-08/","name":"http://www.pdc.kth.se/heimdal/advisory/2006-08-08/","refsource":"CONFIRM","tags":[],"title":"2006-08-08: multiple local privilege escalation vulnerabilities","mime":"text/xml","httpstatus":"404","archivestatus":"200"},{"url":"http://secunia.com/advisories/21467","name":"21467","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"SUSE Update for Multiple Packages - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/21527","name":"21527","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"Ubuntu update for krb5 - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/usn-334-1","name":"USN-334-1","refsource":"UBUNTU","tags":[],"title":"usn/usn-334-1 - Ubuntu: Linux for human beings","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/442599/100/0/threaded","name":"20060808 MITKRB-SA-2006-001: multiple local privilege escalation vulnerabilities","refsource":"BUGTRAQ","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://security.gentoo.org/glsa/glsa-200608-21.xml","name":"GLSA-200608-21","refsource":"GENTOO","tags":[],"title":"Gentoo Linux Documentation\n--\n  Heimdal: Multiple local privilege escalation vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/21436","name":"21436","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"Secunia - Advisories - Heimdal setuid Security Issue","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/21613","name":"21613","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"Gentoo update for heimdal - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/21439","name":"21439","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"Secunia - Advisories - Debian update for krb5","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/23707","name":"23707","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"Fedora Core 5 update for krb5 - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/443498/100/100/threaded","name":"20060816 UPDATED: MITKRB5-SA-2006-001: multiple local privilege escalation vulnerabilities","refsource":"BUGTRAQ","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txt","name":"http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txt","refsource":"CONFIRM","tags":[],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/19427","name":"19427","refsource":"BID","tags":[],"title":"MIT Kerberos 5 Multiple Local Privilege Escalation Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt","name":"ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt","refsource":"CONFIRM","tags":[],"title":"","mime":"text/x-diff","httpstatus":"-1","archivestatus":"200"},{"url":"http://secunia.com/advisories/21461","name":"21461","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"Gentoo update for mit-krb5 - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/401660","name":"VU#401660","refsource":"CERT-VN","tags":["US Government Resource"],"title":"US-CERT Vulnerability Note VU#401660","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/21402","name":"21402","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"Kerberos V5 setuid Security Issue - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/3225","name":"ADV-2006-3225","refsource":"VUPEN","tags":["Vendor Advisory"],"title":"Webmail - OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2006/dsa-1146","name":"DSA-1146","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-1146-1 krb5","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/27871","name":"27871","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-3084","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3084","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"3084","vulnerable":"1","versionEndIncluding":"0.7.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"heimdal","cpe5":"heimdal","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3084","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mit","cpe5":"kerberos_5","cpe6":"1.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3084","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mit","cpe5":"kerberos_5","cpe6":"1.4.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3084","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mit","cpe5":"kerberos_5","cpe6":"1.4.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3084","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mit","cpe5":"kerberos_5","cpe6":"1.4.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3084","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mit","cpe5":"kerberos_5","cpe6":"1.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3084","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mit","cpe5":"kerberos_5","cpe6":"1.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3084","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mit","cpe5":"kerberos_5","cpe6":"1.4.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3084","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mit","cpe5":"kerberos_5","cpe6":"1.4.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3084","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mit","cpe5":"kerberos_5","cpe6":"1.4.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3084","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mit","cpe5":"kerberos_5","cpe6":"1.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-3084","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges.  NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"FEDORA-2007-034","refsource":"FEDORA","url":"http://fedoranews.org/cms/node/2376"},{"name":"http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txt","refsource":"CONFIRM","url":"http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txt"},{"name":"SUSE-SR:2006:020","refsource":"SUSE","url":"http://www.novell.com/linux/security/advisories/2006_20_sr.html"},{"name":"VU#401660","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/401660"},{"name":"GLSA-200608-21","refsource":"GENTOO","url":"http://security.gentoo.org/glsa/glsa-200608-21.xml"},{"name":"21461","refsource":"SECUNIA","url":"http://secunia.com/advisories/21461"},{"name":"21467","refsource":"SECUNIA","url":"http://secunia.com/advisories/21467"},{"name":"27872","refsource":"OSVDB","url":"http://www.osvdb.org/27872"},{"name":"ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt","refsource":"CONFIRM","url":"ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt"},{"name":"DSA-1146","refsource":"DEBIAN","url":"http://www.debian.org/security/2006/dsa-1146"},{"name":"21436","refsource":"SECUNIA","url":"http://secunia.com/advisories/21436"},{"name":"ADV-2006-3225","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/3225"},{"name":"21527","refsource":"SECUNIA","url":"http://secunia.com/advisories/21527"},{"name":"http://www.pdc.kth.se/heimdal/advisory/2006-08-08/","refsource":"CONFIRM","url":"http://www.pdc.kth.se/heimdal/advisory/2006-08-08/"},{"name":"20060808 MITKRB-SA-2006-001: multiple local privilege escalation vulnerabilities","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/442599/100/0/threaded"},{"name":"23707","refsource":"SECUNIA","url":"http://secunia.com/advisories/23707"},{"name":"21439","refsource":"SECUNIA","url":"http://secunia.com/advisories/21439"},{"name":"21402","refsource":"SECUNIA","url":"http://secunia.com/advisories/21402"},{"name":"20060816 UPDATED: MITKRB5-SA-2006-001: multiple local privilege escalation vulnerabilities","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/443498/100/100/threaded"},{"name":"21613","refsource":"SECUNIA","url":"http://secunia.com/advisories/21613"},{"name":"1016664","refsource":"SECTRACK","url":"http://securitytracker.com/id?1016664"},{"name":"GLSA-200608-15","refsource":"GENTOO","url":"http://www.gentoo.org/security/en/glsa/glsa-200608-15.xml"},{"name":"27871","refsource":"OSVDB","url":"http://www.osvdb.org/27871"},{"name":"USN-334-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/usn-334-1"},{"name":"19427","refsource":"BID","url":"http://www.securityfocus.com/bid/19427"}]}},"nvd":{"publishedDate":"2006-08-09 10:04:00","lastModifiedDate":"2020-01-21 15:45:00","problem_types":["CWE-264"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":7.2},"severity":"HIGH","exploitabilityScore":3.9,"impactScore":10,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:heimdal:heimdal:*:*:*:*:*:*:*:*","versionEndIncluding":"0.7.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mit:kerberos_5:1.4:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mit:kerberos_5:1.4.1:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mit:kerberos_5:1.4.2:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mit:kerberos_5:1.4.3:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mit:kerberos_5:1.5:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"3084","Ordinal":"18409","Title":"CVE-2006-3084","CVE":"CVE-2006-3084","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"3084","Ordinal":"1","NoteData":"The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges.  NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.","Type":"Description","Title":null},{"CveYear":"2006","CveId":"3084","Ordinal":"2","NoteData":"2006-08-09","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"3084","Ordinal":"3","NoteData":"2018-10-18","Type":"Other","Title":"Modified"}]}}}