CVE-2006-2194 json
The winbind plugin in pppd for ppp 2.4.4 and earlier does not check the return code from the setuid function call, which might allow local…
published 2006-07-05 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-2195
- cvss
- 7.2
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
The winbind plugin in pppd for ppp 2.4.4 and earlier does not check the return code from the setuid function call, which might allow local users to gain privileges by causing setuid to fail, such as exceeding PAM limits for the maximum number of user processes, which prevents the winbind NTLM authentication helper from dropping privileges.
Patch / fix
- ppp Debian 14, Debian 13, Debian 12 2.4.4rel-1
debian advisories DEBIAN-CVE-2006-2194
- securityfocus.com/bid/18849 patch
- debian.org/security/2006/dsa-1106 advisory
- secunia.com/advisories/20987 advisory
- secunia.com/advisories/20996 advisory
- secunia.com/advisories/20967 advisory
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
References
-
debian.org
/security/2006/dsa-1106
vendor-advisory, patch
-
secunia.com
/advisories/20987
third-party-advisory, patch, vendor-advisory
-
secunia.com
/advisories/20996
third-party-advisory, patch, vendor-advisory
-
secunia.com
/advisories/20967
third-party-advisory, patch, vendor-advisory
-
securityfocus.com
/bid/18849
vdb-entry, patch
-
mandriva.com
/security/advisories?name=MDKSA-2006:119
vendor-advisory
-
ubuntu.com
/usn/usn-310-1
vendor-advisory
-
osvdb.org
/26994
vdb-entry
-
secunia.com
/advisories/20963
third-party-advisory
Sources
- CVE List CVE-2006-2194
- NVD CVE-2006-2194
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.