Search for vulnerabilities
Vulnerability details: VCID-r5ft-5hp2-aaag
Vulnerability ID VCID-r5ft-5hp2-aaag
Aliases CVE-2006-1174
Summary useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.
Status Published
Exploitability 0.5
Weighted Severity 3.3
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-264 Permissions, Privileges, and Access Controls
System Score Found at
rhas Low https://access.redhat.com/errata/RHSA-2007:0276
rhas Low https://access.redhat.com/errata/RHSA-2007:0431
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00101 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.01213 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.01213 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.01213 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
epss 0.01213 https://api.first.org/data/v1/epss?cve=CVE-2006-1174
rhbs low https://bugzilla.redhat.com/show_bug.cgi?id=1618029
cvssv2 3.7 https://nvd.nist.gov/vuln/detail/CVE-2006-1174
Reference id Reference type URL
ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc
http://cvs.pld.org.pl/shadow/NEWS?rev=1.109
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2006-1174.json
https://api.first.org/data/v1/epss?cve=CVE-2006-1174
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1174
http://secunia.com/advisories/20370
http://secunia.com/advisories/20506
http://secunia.com/advisories/25098
http://secunia.com/advisories/25267
http://secunia.com/advisories/25629
http://secunia.com/advisories/25894
http://secunia.com/advisories/25896
http://secunia.com/advisories/26909
http://secunia.com/advisories/27706
https://exchange.xforce.ibmcloud.com/vulnerabilities/26958
https://issues.rpath.com/browse/RPL-1357
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10807
http://support.avaya.com/elmodocs2/security/ASA-2007-249.htm
http://www.gentoo.org/security/en/glsa/glsa-200606-02.xml
http://www.kb.cert.org/vuls/id/312692
http://www.mandriva.com/security/advisories?name=MDKSA-2006:090
http://www.redhat.com/support/errata/RHSA-2007-0276.html
http://www.redhat.com/support/errata/RHSA-2007-0431.html
http://www.securityfocus.com/archive/1/468336/100/0/threaded
http://www.securityfocus.com/bid/18111
http://www.securitytracker.com/id?1018221
http://www.vupen.com/english/advisories/2006/2006
http://www.vupen.com/english/advisories/2007/3229
1618029 https://bugzilla.redhat.com/show_bug.cgi?id=1618029
cpe:2.3:a:debian:shadow:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:debian:shadow:*:*:*:*:*:*:*:*
cpe:2.3:a:debian:shadow:4.0.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:debian:shadow:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:debian:shadow:4.0.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:debian:shadow:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:debian:shadow:4.0.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:debian:shadow:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:debian:shadow:4.0.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:debian:shadow:4.0.4:*:*:*:*:*:*:*
cpe:2.3:a:debian:shadow:4.0.4.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:debian:shadow:4.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:debian:shadow:4.0.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:debian:shadow:4.0.5:*:*:*:*:*:*:*
cpe:2.3:a:debian:shadow:4.0.6:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:debian:shadow:4.0.6:*:*:*:*:*:*:*
CVE-2006-1174 https://nvd.nist.gov/vuln/detail/CVE-2006-1174
GLSA-200606-02 https://security.gentoo.org/glsa/200606-02
RHSA-2007:0276 https://access.redhat.com/errata/RHSA-2007:0276
RHSA-2007:0431 https://access.redhat.com/errata/RHSA-2007:0431
No exploits are available.
Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2006-1174
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.24295
EPSS Score 0.00096
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.