deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2006-4007
Published: 2006-08-07
Description: PHP remote file inclusion vulnerability in index.php in Knusperleicht Guestbook 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the GB_PATH parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1333; http://www.securityfocus.com/archive/1/441810/100/0/threaded; http://www.securityfocus.com/bid/19274
CVE: CVE-2006-4008
Published: 2006-08-07
Description: PHP remote file inclusion vulnerability in index.php in Knusperleicht Faq 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the faq_path parameter.
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1332; http://www.securityfocus.com/archive/1/441812/100/0/threaded; http://www.securityfocus.com/bid/19272
CVE: CVE-2006-4009
Published: 2006-08-07
Description: Cross-site scripting (XSS) vulnerability in war.php in Virtual War (Vwar) 1.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://securityreason.com/securityalert/1331; http://www.securityfocus.com/archive/1/442101/100/0/threaded; http://www.securityfocus.com/archive/1/443171/100/0/threaded
CVE: CVE-2006-4010
Published: 2006-08-07
Description: SQL injection vulnerability in war.php in Virtual War (Vwar) 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter.  NOTE: other vectors are covered by CVE-2006-3139.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2008-02/0186.html; http://securityreason.com/securityalert/1331; http://www.securityfocus.com/archive/1/442101/100/0/threaded
CVE: CVE-2006-4011
Published: 2006-08-07
Description: PHP remote file inclusion vulnerability in esupport/admin/autoclose.php in Kayako eSupport 2.3.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the subd parameter.
CVSS Score: 2.6 (LOW)
References: http://secunia.com/advisories/21330; http://www.securityfocus.com/bid/19315; https://exchange.xforce.ibmcloud.com/vulnerabilities/28199
CVE: CVE-2006-4012
Published: 2006-08-07
Description: Multiple PHP remote file inclusion vulnerabilities in circeOS SaveWeb Portal 3.4 allow remote attackers to execute arbitrary PHP code via a URL in the SITE_Path parameter to (1) poll/poll.php or (2) poll/view_polls.php.  NOTE: the menu_dx.php vector is already covered by CVE-2005-2687.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/16522; http://securityreason.com/securityalert/1336; http://www.securityfocus.com/archive/1/442004/100/0/threaded
CVE: CVE-2006-4013
Published: 2006-08-07
Description: Multiple directory traversal vulnerabilities in Symantec Brightmail AntiSpam (SBAS) before 6.0.4, when the Control Center is allowed to connect from any computer, allow remote attackers to read and overwrite certain files via directory traversal sequences in (1) DATABLOB-GET and (2) DATABLOB-SAVE requests.
CVSS Score: 7.6 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/21223; http://securityresponse.symantec.com/avcenter/security/Content/2006.07.27.html; http://securitytracker.com/id?1016600
CVE: CVE-2006-4014
Published: 2006-08-07
Description: Symantec Brightmail AntiSpam (SBAS) before 6.0.4, when the Control Center is allowed to connect from any computer, allows remote attackers to cause a denial of service (application freeze) "by sending invalid posts".
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21223; http://securityresponse.symantec.com/avcenter/security/Content/2006.07.27.html; http://securitytracker.com/id?1016600
CVE: CVE-2006-4015
Published: 2006-08-07
Description: Hewlett-Packard (HP) ProCurve 3500yl, 6200yl, and 5400zl switches with software before K.11.33 allow remote attackers to cause a denial of service (possibly memory leak or system crash) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21316; http://securityreason.com/securityalert/1335; http://securitytracker.com/id?1016623
CVE: CVE-2006-4016
Published: 2006-08-07
Description: Cross-site scripting (XSS) vulnerability in /toendaCMS in toendaCMS stable 1.0.3 and earlier, and unstable 1.1 and earlier, allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/21344; http://securityreason.com/securityalert/1337; http://securitytracker.com/id?1016636
CVE: CVE-2006-4017
Published: 2006-08-07
Description: Cross-site scripting (XSS) vulnerability in the search module in Inter Network Marketing (INM) CMS G3 allows remote attackers to inject arbitrary web script or HTML via the search_string parameter.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0031.html; http://secunia.com/advisories/21331; http://www.securityfocus.com/archive/1/442007/100/200/threaded
CVE: CVE-2006-4018
Published: 2006-08-08
Description: Heap-based buffer overflow in the pefromupx function in libclamav/upx.c in Clam AntiVirus (ClamAV) 0.81 through 0.88.3 allows remote attackers to execute arbitrary code via a crafted UPX packed file containing sections with large rsize values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://kolab.org/security/kolab-vendor-notice-10.txt; http://secunia.com/advisories/21368; http://secunia.com/advisories/21374
CVE: CVE-2006-4020
Published: 2006-08-08
Description: scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.
CVSS Score: 4.6 (MEDIUM)
References: ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc; http://bugs.php.net/bug.php?id=38322; http://rhn.redhat.com/errata/RHSA-2006-0688.html
CVE: CVE-2006-3114
Published: 2006-08-08
Description: PC Tools AntiVirus 2.1.0.51 uses insecure default permissions on the "PC Tools AntiVirus" directory, which allows local users to gain privileges and execute commands.
CVSS Score: 4.6 (MEDIUM)
References: http://secunia.com/advisories/21075; http://secunia.com/secunia_research/2006-51/advisory/; http://securityreason.com/securityalert/1340
CVE: CVE-2006-3853
Published: 2006-08-08
Description: Buffer overflow in IBM Informix Dynamic Server (IDS) before 9.40.TC7 and 10.00 before 10.00.TC3, when running on Windows, allows remote attackers to execute arbitrary code via a long username.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21301; http://www-1.ibm.com/support/docview.wss?uid=swg21242921; http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
CVE: CVE-2006-3855
Published: 2006-08-08
Description: The ifx_load_internal function in IBM Informix Dynamic Server (IDS) allows remote authenticated users to execute arbitrary C code via the DllMain or _init function in a library, aka "C code UDR."
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/21301; http://www-1.ibm.com/support/docview.wss?uid=swg21242921; http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
CVE: CVE-2006-3856
Published: 2006-08-08
Description: IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 allows local users to cause a denial of service (crash) via unspecified vectors.
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/21301; http://www-1.ibm.com/support/docview.wss?uid=swg21242921; http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
CVE: CVE-2006-3857
Published: 2006-08-08
Description: Multiple buffer overflows in IBM Informix Dynamic Server (IDS) before 9.40.TC6 and 10.00 before 10.00.TC3 allow remote authenticated users to execute arbitrary code via (1) the getname function, as used by (a) _sq_remview, (b) _sq_remproc, (c) _sq_remperms, (d) _sq_distfetch, and (e) _sq_dcatalog; and the (2) SET DEBUG FILE, (3) IFX_FILE_TO_FILE, (4) FILETOCLOB, (5) LOTOFILE, and (6) DBINFO functions (product defect IDs 171649, 171367, 171387, 171391, 171906, 172179).
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/21301; http://www-1.ibm.com/support/docview.wss?uid=swg21242921; http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
CVE: CVE-2006-3858
Published: 2006-08-08
Description: IBM Informix Dynamic Server (IDS) before 9.40.xC8 and 10.00 before 10.00.xC4 stores passwords in plaintext in shared memory, which allows local users to obtain passwords by reading the memory (product defects 171893, 171894, 173772).
CVSS Score: 2.1 (LOW)
References: http://secunia.com/advisories/21301; http://www-1.ibm.com/support/docview.wss?uid=swg21242921; http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
CVE: CVE-2006-3861
Published: 2006-08-08
Description: IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 does not use database creation permissions, which allows remote authenticated users to create arbitrary databases.
CVSS Score: 4.0 (MEDIUM)
References: http://secunia.com/advisories/21301; http://www-1.ibm.com/support/docview.wss?uid=swg21242921; http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
CVE: CVE-2006-3862
Published: 2006-08-08
Description: Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.TC5 through 9.40.xC7 and 10.00.TC1 through 10.00.xC3 allows attackers to execute arbitrary code via the SQLIDEBUG environment variable (envariable).
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21301; http://www-1.ibm.com/support/docview.wss?uid=swg21242921; http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
CVE: CVE-2006-3450
Published: 2006-08-08
Description: Microsoft Internet Explorer 6 allows remote attackers to execute arbitrary code by using the document.getElementByID Javascript function to access crafted Cascading Style Sheet (CSS) elements, and possibly other unspecified vectors involving certain layout positioning combinations in an HTML file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/21396; http://securitytracker.com/id?1016663; http://www.kb.cert.org/vuls/id/119180
CVE: CVE-2006-3451
Published: 2006-08-08
Description: Microsoft Internet Explorer 5 SP4 and 6 do not properly garbage collect when "multiple imports are used on a styleSheets collection" to construct a chain of Cascading Style Sheets (CSS), which allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/21396; http://securityreason.com/securityalert/1343; http://securitytracker.com/id?1016663
CVE: CVE-2006-3583
Published: 2006-08-08
Description: Session fixation vulnerability in Jetbox CMS 2.1 SR1 allows remote attackers to hijack web sessions via a crafted link and the administrator section.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/20889; http://secunia.com/secunia_research/2006-57/advisory/; http://securityreason.com/securityalert/1339
CVE: CVE-2006-3584
Published: 2006-08-08
Description: Dynamic variable evaluation vulnerability in index.php in Jetbox CMS 2.1 SR1 allows remote attackers to overwrite configuration variables via URL parameters, which are evaluated as PHP variable variables.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20889; http://secunia.com/secunia_research/2006-57/advisory/; http://securityreason.com/securityalert/1339
CVE: CVE-2006-3585
Published: 2006-08-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS 2.1 SR1 allow remote attackers to inject arbitrary web script or HTML via the (1) login parameter in admin/cms/index.php, (2) unspecified parameters in the "Supply news" page in formmail.php, (3) the URL in the "Site statistics" page, and the (5) query_string parameter when performing a search.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/20889; http://secunia.com/secunia_research/2006-57/advisory/; http://securityreason.com/securityalert/1339
CVE: CVE-2006-3586
Published: 2006-08-08
Description: SQL injection vulnerability in Jetbox CMS 2.1 SR1 allows remote attackers to execute arbitrary SQL commands via the (1) frontsession COOKIE parameter and (2) view parameter in index.php, and the (3) login parameter in admin/cms/index.php.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/20889; http://secunia.com/secunia_research/2006-57/advisory/; http://securityreason.com/securityalert/1339
CVE: CVE-2006-3637
Published: 2006-08-08
Description: Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle various HTML layout component combinations, which allows user-assisted remote attackers to execute arbitrary code via a crafted HTML file that leads to memory corruption, aka "HTML Rendering Memory Corruption Vulnerability."
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21396; http://securitytracker.com/id?1016663; http://www.kb.cert.org/vuls/id/340060
CVE: CVE-2006-3638
Published: 2006-08-08
Description: Microsoft Internet Explorer 5.01 and 6 does not properly handle uninitialized COM objects, which allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code, as demonstrated by the Nth function in the DirectAnimation.DATuple ActiveX control, aka "COM Object Instantiation Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/21396; http://securitytracker.com/id?1016663; http://www.kb.cert.org/vuls/id/959049
CVE: CVE-2006-3438
Published: 2006-08-09
Description: Unspecified vulnerability in Microsoft Hyperlink Object Library (hlink.dll), possibly a buffer overflow, allows user-assisted attackers to execute arbitrary code via crafted hyperlinks that are not properly handled when hlink.dll "uses a file containing a malformed function," aka "Hyperlink Object Function Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://securitytracker.com/id?1016659; http://www.kb.cert.org/vuls/id/683612; http://www.securityfocus.com/bid/19405
CVE: CVE-2006-3444
Published: 2006-08-09
Description: Unspecified vulnerability in the kernel in Microsoft Windows 2000 SP4, probably a buffer overflow, allows local users to obtain privileges via unspecified vectors involving an "unchecked buffer."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21415; http://securitytracker.com/id?1016658; http://www.securityfocus.com/bid/19388
CVE: CVE-2006-3449
Published: 2006-08-09
Description: Unspecified vulnerability in Microsoft PowerPoint 2000 through 2003, possibly a buffer overflow, allows user-assisted remote attackers to execute arbitrary commands via a malformed record in the BIFF file format used in a PPT file, a different issue than CVE-2006-1540, aka "Microsoft PowerPoint Malformed Record Vulnerability."
CVSS Score: 7.5 (HIGH)
References: http://securityreason.com/securityalert/1342; http://securitytracker.com/id?1016657; http://secway.org/advisory/AD20060808.txt
CVE: CVE-2006-3639
Published: 2006-08-09
Description: Microsoft Internet Explorer 5.01 and 6 does not properly identify the originating domain zone when handling redirects, which allows remote attackers to read cross-domain web pages and possibly execute code via unspecified vectors involving a crafted web page, aka "Source Element Cross-Domain Vulnerability."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21396; http://securitytracker.com/id?1016663; http://www.kb.cert.org/vuls/id/252764
CVE: CVE-2006-3640
Published: 2006-08-09
Description: Microsoft Internet Explorer 5.01 and 6 allows certain script to persist across navigations between pages, which allows remote attackers to obtain the window location of visited web pages in other domains or zones, aka "Window Location Information Disclosure Vulnerability."
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/21396; http://securitytracker.com/id?1016663; http://www.osvdb.org/27850
CVE: CVE-2006-3643
Published: 2006-08-09
Description: Cross-site scripting (XSS) vulnerability in Internet Explorer 5.01 and 6 in Microsoft Windows 2000 SP4 permits access to local "HTML-embedded resource files" in the Microsoft Management Console (MMC) library, which allows remote authenticated users to execute arbitrary commands, aka "MMC Redirect Cross-Site Scripting Vulnerability."
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/21401; http://securitytracker.com/id?1016655; http://www.kb.cert.org/vuls/id/927548
CVE: CVE-2006-3649
Published: 2006-08-09
Description: Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows user-assisted attackers to execute arbitrary code via unspecified document properties that are not verified when VBA is invoked to open documents.
CVSS Score: 5.1 (MEDIUM)
References: http://secunia.com/advisories/21408; http://securitytracker.com/id?1016656; http://www.kb.cert.org/vuls/id/159484
CVE: CVE-2006-4022
Published: 2006-08-09
Description: Intel 2100 PRO/Wireless Network Connection driver PROSet before 7.1.4.6 allows local users to corrupt memory and execute code via "requests for capabilities from higher-level protocol drivers or user-level applications" involving crafted frames, a different issue than CVE-2006-3992.
CVSS Score: 4.6 (MEDIUM)
References: http://securitytracker.com/id?1016621; http://support.intel.com/support/wireless/wlan/pro2100/sb/CS-023067.htm; http://www.kb.cert.org/vuls/id/824500
CVE: CVE-2006-4023
Published: 2006-08-09
Description: The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a valid network IP address, which allows remote attackers to obtain network information and facilitate other attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.  NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way that is similar to strcpy's role in buffer overflows, in which case this would be a class of implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a security-relevant manner.
CVSS Score: 5.0 (MEDIUM)
References: http://retrogod.altervista.org/php_ip2long.htm; http://securitytracker.com/id?1016609; http://www.securityfocus.com/archive/1/441529/100/100/threaded
CVE: CVE-2006-4024
Published: 2006-08-09
Description: The FESTAHES_Load function in pce/hes.c in Festalon 0.5.0 through 0.5.5 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative LoadAddr value in a HES file, which is used as an offset in a memcpy operation and leads to a buffer underflow.
CVSS Score: 7.5 (HIGH)
References: http://aluigi.altervista.org/adv/festahc-adv.txt; http://secunia.com/advisories/21367; http://www.securityfocus.com/bid/19402
CVE: CVE-2006-4025
Published: 2006-08-09
Description: SQL injection vulnerability in profile.php in XennoBB 2.1.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the (1) bday_day, (2) bday_month, and (3) bday_year parameters in the personal section.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/21409; http://securityreason.com/securityalert/1344; http://securitytracker.com/id?1016643
CVE: CVE-2006-4026
Published: 2006-08-09
Description: PHP remote file inclusion vulnerability in SAPID CMS 123 rc3 allows remote attackers to execute arbitrary PHP code via a URL in the (1) root_path parameter in usr/extensions/get_infochannel.inc.php and the (2) GLOBALS["root_path"] parameter in usr/extensions/get_tree.inc.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/21410; http://securityreason.com/securityalert/1346; http://securitytracker.com/id?1016650
CVE: CVE-2006-3439
Published: 2006-08-09
Description: Buffer overflow in the Server Service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers, including anonymous users, to execute arbitrary code via a crafted RPC message, a different vulnerability than CVE-2006-1314.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21388; http://securitytracker.com/id?1016667; http://www.cisco.com/en/US/products/ps6120/tsd_products_security_response09186a008070c75a.html
CVE: CVE-2006-3440
Published: 2006-08-09
Description: Buffer overflow in the Winsock API in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via unknown vectors, aka "Winsock Hostname Vulnerability."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21394; http://securitytracker.com/id?1016653; http://www.kb.cert.org/vuls/id/908276
CVE: CVE-2006-3441
Published: 2006-08-09
Description: Buffer overflow in the DNS Client service in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted record response.  NOTE: while MS06-041 implies that there is a single issue, there are multiple vectors, and likely multiple vulnerabilities, related to (1) a heap-based buffer overflow in a DNS server response to the client, (2) a DNS server response with malformed ATMA records, and (3) a length miscalculation in TXT, HINFO, X25, and ISDN records.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/21394; http://securitytracker.com/id?1016653; http://www.kb.cert.org/vuls/id/794580
CVE: CVE-2006-3443
Published: 2006-08-09
Description: Untrusted search path vulnerability in Winlogon in Microsoft Windows 2000 SP4, when SafeDllSearchMode is disabled, allows local users to gain privileges via a malicious DLL in the UserProfile directory, aka "User Profile Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/21417; http://securitytracker.com/id?1016662; http://www.kb.cert.org/vuls/id/337244
CVE: CVE-2006-3648
Published: 2006-08-09
Description: Unspecified vulnerability in Microsoft Windows 2000 SP4, XP SP1 and SP2, Server 2003 and 2003 SP1, allows remote attackers to execute arbitrary code via unspecified vectors involving unhandled exceptions, memory resident applications, and incorrectly "unloading chained exception."
CVSS Score: 7.6 (HIGH)
References: http://securitytracker.com/id?1016661; http://www.kb.cert.org/vuls/id/411516; http://www.securityfocus.com/bid/19384
CVE: CVE-2006-3083
Published: 2006-08-09
Description: The (1) krshd and (2) v4rcp applications in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges using attacks such as resource exhaustion.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt; http://secunia.com/advisories/21402; http://secunia.com/advisories/21423
CVE: CVE-2006-3084
Published: 2006-08-09
Description: The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges.  NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt; http://fedoranews.org/cms/node/2376; http://secunia.com/advisories/21402