CVE-2006-6008

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-11-21 · updated 2026-06-16

Description

ftpd in Linux Netkit (linux-ftpd) 0.17, and possibly other versions, does not check the return status of certain seteuid, setgid, and setuid calls, which might allow remote authenticated users to gain privileges if these calls fail in cases such as PAM failures or resource limits, a different vulnerability than CVE-2006-5778.

Affected products

Netkit: 0.17

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384454
http://bugs.gentoo.org/show_bug.cgi?id=150292
http://ftp.debian.org/debian/pool/main/l/linux-ftpd/linux-ftpd_0.17-22.diff.gz
http://secunia.com/advisories/22816
http://secunia.com/advisories/22853
http://www.gentoo.org/security/en/glsa/glsa-200611-05.xml
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384454
http://bugs.gentoo.org/show_bug.cgi?id=150292
http://ftp.debian.org/debian/pool/main/l/linux-ftpd/linux-ftpd_0.17-22.diff.gz
http://secunia.com/advisories/22816
http://secunia.com/advisories/22853
http://www.gentoo.org/security/en/glsa/glsa-200611-05.xml

Get alerted when CVE-2006-6008 or the next vulnerability affects your stack