CVE-2006-3597

passwd before 1:4.0.13 on Ubuntu 6.06 LTS leaves the root password blank instead of locking it when the administrator selects the "Go Back" option after the final "Installation complete" message and uses the main menu, which causes the password to be zeroed out in the installer's memory.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://secunia.com/advisories/21022	Patch Vendor Advisory
http://www.osvdb.org/27091
http://www.ubuntu.com/usn/usn-316-1	Exploit Patch
http://secunia.com/advisories/21022	Patch Vendor Advisory
http://www.osvdb.org/27091
http://www.ubuntu.com/usn/usn-316-1	Exploit Patch

Configurations

Configuration 1 (hide)

cpe:2.3:o:ubuntu:ubuntu_linux:6.06_lts:*:*:*:*:*:*:*

History

21 Nov 2024, 00:13

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/21022 - Patch, Vendor Advisory~~	() http://secunia.com/advisories/21022 - Patch, Vendor Advisory
References	~~() http://www.osvdb.org/27091 -~~	() http://www.osvdb.org/27091 -
References	~~() http://www.ubuntu.com/usn/usn-316-1 - Exploit, Patch~~	() http://www.ubuntu.com/usn/usn-316-1 - Exploit, Patch

Information

Published : 2006-07-18 15:37

Updated : 2024-11-21 00:13

NVD link : CVE-2006-3597

Mitre link : CVE-2006-3597

CVE.ORG link : CVE-2006-3597

JSON object : View

Products Affected

ubuntu

ubuntu_linux

CWE

NVD-CWE-Other

{"id": "CVE-2006-3597", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-07-18T15:37:00.000", "references": [{"url": "http://secunia.com/advisories/21022", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/27091", "source": "cve@mitre.org"}, {"url": "http://www.ubuntu.com/usn/usn-316-1", "tags": ["Exploit", "Patch"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/21022", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/27091", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.ubuntu.com/usn/usn-316-1", "tags": ["Exploit", "Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "passwd before 1:4.0.13 on Ubuntu 6.06 LTS leaves the root password blank instead of locking it when the administrator selects the \"Go Back\" option after the final \"Installation complete\" message and uses the main menu, which causes the password to be zeroed out in the installer's memory."}, {"lang": "es", "value": "passwd anterior a 1:4.0.13 sobre Ubuntu 6.06 LTS deja la contrase\u00f1a de root en blanco en vez de cerrarlo cuando el administrador selecciona la opci\u00f3n \"Go Back\" despu\u00e9s del mensaje final \"instalaci\u00f3n completa\" y utiliza el menu principal, lo que provoca que la contrase\u00f1a que se ponga a cero fuera de la memoria del instalador."}], "lastModified": "2024-11-21T00:13:59.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ubuntu:ubuntu_linux:6.06_lts:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8517E55-4357-4AFD-B571-5533123CB014"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}