CVE-2006-1174

Severity: low (CVSS 3.7 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-05-28 · updated 2026-06-16
Weakness: CWE-264

Description

useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.

Affected products

Debian Shadow: through 4.0.7; 4.0.0, 4.0.1, 4.0.2, 4.0.4, 4.0.4.1, 4.0.5 (+1)

References

http://cvs.pld.org.pl/shadow/NEWS?rev=1.109
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
http://secunia.com/advisories/20370
http://secunia.com/advisories/20506
http://secunia.com/advisories/25098
http://secunia.com/advisories/25267
http://secunia.com/advisories/25629
http://secunia.com/advisories/25894
http://secunia.com/advisories/25896
http://secunia.com/advisories/26909
http://secunia.com/advisories/27706

Get alerted when CVE-2006-1174 or the next vulnerability affects your stack