NVD

Id
61302  
Name
CVE-2006-2607  
Description
do_command.c in Vixie cron (vixie-cron) 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in /etc/security/limits.conf.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2016-12-20  
Published
2006-05-25  
Modified Date
2011-03-07  
Seq
2006-2607  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
316742 61302 CVE-2006-2607 http://bugs.gentoo.org/show_bug.cgi?id=134194  View
316743 61302 CVE-2006-2607 oval:org.mitre.oval:def:10213  View
316744 61302 CVE-2006-2607 GLSA-200606-07  View
316745 61302 CVE-2006-2607 1016480  View
316746 61302 CVE-2006-2607 http://support.avaya.com/elmodocs2/security/ASA-2006-168.htm  View
316747 61302 CVE-2006-2607 SUSE-SA:2006:027  View
316748 61302 CVE-2006-2607 RHSA-2006:0539  View
316749 61302 CVE-2006-2607 20060525 rPSA-2006-0082-1 vixie-cron  View
316750 61302 CVE-2006-2607 18108  View
316751 61302 CVE-2006-2607 USN-778-1  View
316752 61302 CVE-2006-2607 ADV-2006-2075  View
316753 61302 CVE-2006-2607 vixie-cron-docommand-gain-privilege(26691)  View
316754 61302 CVE-2006-2607 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178431  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
58118 JVNDB-2006-000314 Vixie Cron の do_command.c における権限昇格の脆弱性 Vixie Cron の do_command.c では、ユーザが設定したジョブ (プログラム) を実行する前に setuid() 関数の戻り値を適切に確認しない脆弱性が存在します。 CVE-2006-2607 18709 CVE-2006-2607 61302 7.2 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-000314.html 2006-06-01 2007-04-01 View