CVE-2006-2194 Privilege escalation in n/a
Local attackers can gain privileges by causing the winbind plugin in pppd to fail dropping privileges due to unchecked setuid return codes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-2194?
CVE-2006-2194 is a high-severity vulnerability in n/a, published on 5 Jul 2006. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The winbind plugin in pppd for ppp 2.4.4 and earlier does not check the return code from the setuid function call, which might allow local users to gain privileges by causing setuid to fail, such as exceeding PAM limits for the maximum number of user processes, which prevents the winbind NTLM authentication helper from dropping privileges.
Which versions are affected by CVE-2006-2194?
It affects 1 product.
Products include Point-to-Point Protocol Project Point-to-Point Protocol.
How do I fix CVE-2006-2194?
Apply the vendor's patch.
Is CVE-2006-2194 being exploited?
There is no known exploitation of CVE-2006-2194 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2006-2194, DSA-1106, GHSA-wh53-gc5h-qjj9.