CVE-2006-0056 Use after free in n/a
Remote attackers can cause denial of service or execute arbitrary code via crafted passwords in specific PAM-MySQL configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-0056?
CVE-2006-0056 is a high-severity use after free vulnerability in n/a, published on 13 Feb 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Double free vulnerability in the authentication and authentication token alteration code in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted passwords, which lead to a double free of a pointer that was created by the pam_get_item function. NOTE: this issue only occurs in certain configurations in which there are multiple PAM modules, PAM-MySQL is not evaluated first, and there are no requisite modules before PAM-MySQL.
Weakness: CWE-119
Which versions are affected by CVE-2006-0056?
It affects 1 product.
Products include Pam-Mysql Pam-Mysql.
How do I fix CVE-2006-0056?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2006-0056 being exploited?
There is no known exploitation of CVE-2006-0056 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2006-0056, GHSA-w6xf-p38w-6xgp.