CVE-2006-6008

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

ftpd in Linux Netkit (linux-ftpd) 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different vulnerability than CVE-2006-5778.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384454Patch
http://bugs.gentoo.org/show_bug.cgi?id=150292Patch
http://ftp.debian.org/debian/pool/main/l/linux-ftpd/linux-ftpd_0.17-22.diff.gzPatch
http://secunia.com/advisories/22816Patch, Vendor Advisory
http://secunia.com/advisories/22853Patch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200611-05.xmlPatch, Vendor Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384454Patch
http://bugs.gentoo.org/show_bug.cgi?id=150292Patch
http://ftp.debian.org/debian/pool/main/l/linux-ftpd/linux-ftpd_0.17-22.diff.gzPatch
http://secunia.com/advisories/22816Patch, Vendor Advisory
http://secunia.com/advisories/22853Patch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200611-05.xmlPatch, Vendor Advisory

Timeline

Published: Nov 21, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-60095.0Unspecified vulnerability in the Java Runtime Environment (JRE) Swing library in JDK and JRE 5.0 Update 7 and earlier allows attackers to ob CVE-2006-60105.0SAP allows remote attackers to obtain potentially sensitive information such as operating system and SAP version via an RFC_SYSTEM_INFO RfcC CVE-2006-60115.0Unspecified vulnerability in SAP Web Application Server before 6.40 patch 6 allows remote attackers to cause a denial of service (enserver.e CVE-2006-60124.3Cross-site scripting (XSS) vulnerability in csm/asp/listings.asp in MGinternet Car Site Manager (CSM) allows remote attackers to inject arbi CVE-2006-60132.1Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kerne CVE-2006-60147.2The NetBSD-current kernel before 20061028 does not properly perform bounds checking of an unspecified userspace parameter in the ptrace syst CVE-2006-60155.0Buffer overflow in the JavaScript implementation in Safari on Apple Mac OS X 10.4 allows remote attackers to cause a denial of service (appl CVE-2006-60166.5wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified CVE-2006-60176.5WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote auth CVE-2006-60187.5PHP remote file inclusion vulnerability in mybic_server.php in Jim Plush My-BIC 0.6.5 allows remote attackers to execute arbitrary PHP code CVE-2006-60196.8Cross-site scripting (XSS) vulnerability in extensions/googiespell/googlespell_proxy.php in Bill Roberts Bloo 1.0 allows remote attackers to CVE-2006-60206.8Cross-site scripting (XSS) vulnerability in announce.php in Blog Torrent Preview 0.92 allows remote attackers to inject arbitrary web script