Description
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | krb5 | 1.4.3-9 | — |
| Debian 13 | krb5 | 1.4.3-9 | — |
| Debian 12 | krb5 | 1.4.3-9 | — |
| Debian 3.1 | krb5 | 1.3.6-2sarge3 | DSA-1146-1 |
Advisories 1
- DSA-1146-1 krb5 - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2007-034 vendor-advisory
- http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txt
- SUSE-SR:2006:020 vendor-advisory
- VU#401660 third-party-advisory
- GLSA-200608-21 vendor-advisory
- 21461 third-party-advisory
- 21467 third-party-advisory
- 27872 vdb-entry
- DSA-1146 vendor-advisory
- 21436 third-party-advisory
- ADV-2006-3225 vdb-entry
- 21527 third-party-advisory
- http://www.pdc.kth.se/heimdal/advisory/2006-08-08/
- 20060808 MITKRB-SA-2006-001: multiple local privilege escalation vulnerabilities mailing-list
- 23707 third-party-advisory
- 21439 third-party-advisory
- 21402 third-party-advisory
- 20060816 UPDATED: MITKRB5-SA-2006-001: multiple local privilege escalation vulnerabilities mailing-list
- 21613 third-party-advisory
- 1016664 vdb-entry
- GLSA-200608-15 vendor-advisory
- 27871 vdb-entry
- USN-334-1 vendor-advisory
- 19427 vdb-entry