CVE-2006-7094 Privilege escalation in n/a
Remote authenticated users can list arbitrary directories with root privileges due to incorrect group ID handling in ftpd.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-7094?
CVE-2006-7094 is a high-severity vulnerability in n/a, published on 28 Feb 2007. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ftpd, as used by Gentoo and Debian Linux, sets the gid to the effective uid instead of the effective group id before executing /bin/ls, which allows remote authenticated users to list arbitrary directories with the privileges of gid 0 and possibly enable additional attack vectors.
Which versions are affected by CVE-2006-7094?
It affects 1 product.
Products include Ftpd Ftpd.
How do I fix CVE-2006-7094?
Apply the vendor's patch.
Is CVE-2006-7094 being exploited?
There is no known exploitation of CVE-2006-7094 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2006-7094, GHSA-2m99-h743-796m.