Privilege Escalation Vulnerability in pppd's Winbind Plugin by Open System Vendors
CVE-2006-2194

Currently unrated

Key Information:

Vendor: Point-to-point Protocol Project
Status: Point-to-point Protocol
Vendor: CVE Published:; 5 July 2006

🔔 Create Point-to-point Protocol Project Vulnerability Alert

What is CVE-2006-2194?

The winbind plugin in pppd prior to version 2.4.4 lacks proper validation of the setuid function's return code. This flaw allows local users to potentially exploit PAM limits for user processes, preventing the NTLM authentication helper from effectively dropping privileges. This could result in unauthorized access elevation.

References

http://www.mandriva.com/security/advisories?name=MDKSA-20...

vendor-advisoryx_refsource_MANDRIVA

http://www.osvdb.org/26994

vdb-entryx_refsource_OSVDB

http://www.debian.org/security/2006/dsa-1106

vendor-advisoryx_refsource_DEBIAN

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 5, 2006
Vulnerability Reserved
May 4, 2006

CVE-2006-2194 Data

JSON