NVD - Detail

Mission and Overview

NVD is the U.S. government repository of standards based vulnerability management data. This data enables automation of vulnerability management, security measurement, and compliance (e.g. FISMA).

Resource Status

NVD contains:

74425

334

249

4402

10286

107533

Last updated: 1/5/2016 3:41:25 PM

CVE Publication rate: 18.5

Email List

NVD provides four mailing lists to the public. For information and subscription instructions please visit NVD Mailing Lists

Workload Index

Vulnerability Workload Index: 10.54

About Us

NVD is a product of the NIST Computer Security Division and is sponsored by the Department of Homeland Security's National Cyber Security Division. It supports the U.S. government multi-agency (OSD, DHS, NSA, DISA, and NIST) Information Security Automation Program. It is the U.S. government content repository for the Security Content Automation Protocol (SCAP).

NIST Security Configuration Checklists - CSD

National Cyber Awareness System

Vulnerability Summary for CVE-2006-2451

Original release date: 07/07/2006

Last revised: 03/19/2012

Source: US-CERT/NIST

Overview

The suid_dumpable support in Linux kernel 2.6.13 up to versions before 2.6.17.4, and 2.6.16 before 2.6.16.24, allows a local user to cause a denial of service (disk consumption) and possibly gain privileges via the PR_SET_DUMPABLE argument of the prctl function and a program that causes a core dump file to be created in a directory for which the user does not have permissions.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.6 (MEDIUM) (AV:L/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 3.9

CVSS Version 2 Metrics:

Access Vector: Locally exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.17.y.git;a=commit;h=0af184bb9f80edfbb94de46cb52e9592e5a547b0

Hyperlink: http://www.kernel.org/git/?p=linux/kernel/git/stable/linux-2.6.17.y.git;a=commit;h=0af184bb9f80edfbb94de46cb52e9592e5a547b0

External Source: MISC

Name: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=195902

Hyperlink: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=195902

External Source: BUGTRAQ

Name: 20060710 Re: rPSA-2006-0122-1 kernel

Hyperlink: http://www.securityfocus.com/archive/1/439610/100/100/threaded

External Source: VUPEN

Name: ADV-2006-2699

Type: Advisory

Hyperlink: http://www.vupen.com/english/advisories/2006/2699

External Source: SECTRACK

Name: 1016451

Hyperlink: http://securitytracker.com/id?1016451

External Source: UBUNTU

Name: USN-311-1

Hyperlink: http://www.ubuntu.com/usn/usn-311-1

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-488

Hyperlink: https://issues.rpath.com/browse/RPL-488

External Source: CONFIRM

Name: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.24

Hyperlink: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.24

External Source: BID

Name: 18874

Hyperlink: http://www.securityfocus.com/bid/18874

External Source: REDHAT

Name: RHSA-2006:0574

Hyperlink: http://www.redhat.com/support/errata/RHSA-2006-0574.html

External Source: SUSE

Name: SUSE-SR:2006:017

Hyperlink: http://www.novell.com/linux/security/advisories/2006_17_sr.html

External Source: OVAL

Name: oval:org.mitre.oval:def:11336

Hyperlink: http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11336

External Source: BUGTRAQ

Name: 20060713 Linux sys_prctl LKM based hotfix

Hyperlink: http://www.securityfocus.com/archive/1/archive/1/440118/100/0/threaded

External Source: BUGTRAQ

Name: 20060707 rPSA-2006-0122-1 kernel

Hyperlink: http://www.securityfocus.com/archive/1/archive/1/439483/100/100/threaded

External Source: BUGTRAQ

Name: 20060714 Linux Kernel 2.6.x PRCTL Core Dump Handling -- Simple workaround

Hyperlink: http://www.securityfocus.com/archive/1/archive/1/440057/100/0/threaded

External Source: BUGTRAQ

Name: 20060712 Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00t Exploit ( BID 18874 / CVE-2006-2451 )

Hyperlink: http://www.securityfocus.com/archive/1/archive/1/439869/100/0/threaded

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-162.htm

Hyperlink: http://support.avaya.com/elmodocs2/security/ASA-2006-162.htm

External Source: BUGTRAQ

Name: 20060716 Re: Linux Kernel 2.6.x PRCTL Core Dump Handling -- Simple workaround

Hyperlink: http://www.securityfocus.com/archive/1/archive/1/440379/100/0/threaded

External Source: SUSE

Name: SUSE-SA:2006:049

Hyperlink: http://www.novell.com/linux/security/advisories/2006_49_kernel.html

External Source: CONFIRM

Name: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.17.4

Hyperlink: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.17.4

External Source: OSVDB

Name: 27030

Hyperlink: http://www.osvdb.org/27030

External Source: SUSE

Name: SUSE-SA:2006:047

Hyperlink: http://www.novell.com/linux/security/advisories/2006_47_kernel.html

External Source: SUSE

Name: SUSE-SA:2006:042

Hyperlink: http://www.novell.com/linux/security/advisories/2006_42_kernel.html

External Source: SUSE

Name: SUSE-SR:2006:016

Hyperlink: http://www.novell.com/linux/security/advisories/2006_16_sr.html

External Source: BUGTRAQ

Name: 20060713 Re: [Full-disclosure] Re: Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00t Exploit ( BID 18874 / CVE-2006-2451 )

Hyperlink: http://www.securityfocus.com/archive/1/archive/1/440117/100/0/threaded

References to Check Content

Identifier: oval:org.mitre.oval:def:11336

Check System: http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink: http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:11336

Vulnerable software and versions

* Denotes Vulnerable Software
Changes related to vulnerability configurations

Technical Details

Vulnerability Type (View All)

Resource Management Errors (CWE-399)

CVE Standard Vulnerability Entry http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2451

You are viewing this page in an unauthorized frame window.

National Cyber Awareness System

Vulnerability Summary for CVE-2006-2451

Overview

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

References to Check Content

Vulnerable software and versions

Technical Details