CVE-2006-1174
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide...
CVE-2006-1174 is a low vulnerability (CVSS 3.7) in Debian Shadow, published May 28, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in shadow 1:4.0.15-10.
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.
Exploit likelihood
What each source reports
NVD Score used
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.
- Record
CVE-2006-1174- CVSS 2.0
- 3.7 Low
AV:L/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.
- Record
CVE-2006-1174- Updated
- 2026-11-02
EUVDEUVD-2006-1178 No score
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.
- Record
EUVD-2006-1178- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2fgw-2v2m-w7mc No score
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide...
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.
- Record
GHSA-2fgw-2v2m-w7mc- Updated
- 2026-11-02
OSV No score
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.
- Record
CVE-2006-1174- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-1174 No score
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a required argument to the open function when creating a new user mailbox, which causes the mailbox to be created with unpredictable permissions and possibly allows attackers to read or modify the mailbox.
- Record
DEBIAN-CVE-2006-1174- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shadowDebian:12 |
before 1:4.0.15-10 | 1:4.0.15-10 |
shadowDebian:13 |
before 1:4.0.15-10 | 1:4.0.15-10 |
shadowDebian:14 |
before 1:4.0.15-10 | 1:4.0.15-10 |
shadow-utilsRed Hat:enterprise_linux:4::as |
before 2:4.0.3-61.RHEL4 | 2:4.0.3-61.RHEL4 |
shadow-utils-debuginfoRed Hat:enterprise_linux:4::as |
before 2:4.0.3-61.RHEL4 | 2:4.0.3-61.RHEL4 |
shadow-utilsRed Hat:enterprise_linux:4::desktop |
before 2:4.0.3-61.RHEL4 | 2:4.0.3-61.RHEL4 |
shadow-utils-debuginfoRed Hat:enterprise_linux:4::desktop |
before 2:4.0.3-61.RHEL4 | 2:4.0.3-61.RHEL4 |
shadow-utilsRed Hat:enterprise_linux:4::es |
before 2:4.0.3-61.RHEL4 | 2:4.0.3-61.RHEL4 |
shadow-utils-debuginfoRed Hat:enterprise_linux:4::es |
before 2:4.0.3-61.RHEL4 | 2:4.0.3-61.RHEL4 |
shadow-utilsRed Hat:enterprise_linux:4::ws |
before 2:4.0.3-61.RHEL4 | 2:4.0.3-61.RHEL4 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
shadow-utils-debuginfoRed Hat:enterprise_linux:4::ws |
before 2:4.0.3-61.RHEL4 | 2:4.0.3-61.RHEL4 |
shadow-utilsRed Hat:enterprise_linux:3::as |
before 2:4.0.3-29.RHEL3 | 2:4.0.3-29.RHEL3 |
shadow-utils-debuginfoRed Hat:enterprise_linux:3::as |
before 2:4.0.3-29.RHEL3 | 2:4.0.3-29.RHEL3 |
shadow-utilsRed Hat:enterprise_linux:3::desktop |
before 2:4.0.3-29.RHEL3 | 2:4.0.3-29.RHEL3 |
shadow-utils-debuginfoRed Hat:enterprise_linux:3::desktop |
before 2:4.0.3-29.RHEL3 | 2:4.0.3-29.RHEL3 |
shadow-utilsRed Hat:enterprise_linux:3::es |
before 2:4.0.3-29.RHEL3 | 2:4.0.3-29.RHEL3 |
shadow-utils-debuginfoRed Hat:enterprise_linux:3::es |
before 2:4.0.3-29.RHEL3 | 2:4.0.3-29.RHEL3 |
shadow-utilsRed Hat:enterprise_linux:3::ws |
before 2:4.0.3-29.RHEL3 | 2:4.0.3-29.RHEL3 |
shadow-utils-debuginfoRed Hat:enterprise_linux:3::ws |
before 2:4.0.3-29.RHEL3 | 2:4.0.3-29.RHEL3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
secunia.com/advisories/25098
redhat.com/support/errata/RHSA-2007-0431.html
vupen.com/english/advisories/2007/3229
Show 38 moreShow less
support.avaya.com/elmodocs2/security/ASA-2007-249.htm
securityfocus.com/bid/18111
securitytracker.com/id?1018221
cvs.pld.org.pl/shadow/NEWS?rev=1.109
exchange.xforce.ibmcloud.com/vulnerabilities/26958
kb.cert.org/vuls/id/312692
gentoo.org/security/en/glsa/glsa-200606-02.xml
mandriva.com/security/advisories?name=MDKSA-2006:090
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10807
issues.rpath.com/browse/RPL-1357
nvd.nist.gov/vuln/detail/CVE-2006-1174
github.com/advisories/GHSA-2fgw-2v2m-w7mc
security-tracker.debian.org/tracker/CVE-2006-1174
access.redhat.com/errata/RHSA-2007:0276
bugzilla.redhat.com/show_bug.cgi?id=176951
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0276.json
cve.org/CVERecord?id=CVE-2006-1174