{"id":"CVE-2006-7108","aliases":["DEBIAN-CVE-2006-7108","EUVD-2006-7090","GHSA-224c-qxxc-fqx7","RHSA-2007:0235"],"status":"published","title":"login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such...","description":"login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.","severity":{"version":"2.0","score":4.1,"vector":"AV:L/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00348,"percentile":0.28674,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2007-03-04T22:00:00Z","modified":"2026-10-22T23:47:22Z","fixes":[{"ecosystem":"Debian:12","package":"util-linux","fixed_in":["2.17.2-9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"util-linux","fixed_in":["2.17.2-9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"util-linux","fixed_in":["2.17.2-9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"util-linux","fixed_in":["0:2.12a-16.EL4.25"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"util-linux-debuginfo","fixed_in":["0:2.12a-16.EL4.25"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"util-linux","fixed_in":["0:2.12a-16.EL4.25"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"util-linux-debuginfo","fixed_in":["0:2.12a-16.EL4.25"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"util-linux","fixed_in":["0:2.12a-16.EL4.25"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"util-linux-debuginfo","fixed_in":["0:2.12a-16.EL4.25"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"util-linux","fixed_in":["0:2.12a-16.EL4.25"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"util-linux-debuginfo","fixed_in":["0:2.12a-16.EL4.25"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-9"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12a-16.EL4.25"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"util-linux-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12a-16.EL4.25"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12a-16.EL4.25"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"util-linux-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12a-16.EL4.25"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12a-16.EL4.25"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"util-linux-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12a-16.EL4.25"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12a-16.EL4.25"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"util-linux-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.12a-16.EL4.25"}]}]}],"products":[{"vendor":"andries_brouwer","product":"util-linux"}],"references":[{"url":"http://secunia.com/advisories/25098","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://issues.rpath.com/browse/RPL-1359","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/25935","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/24321","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.redhat.com/support/errata/RHSA-2007-0235.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2007:111","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/25692","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/25530","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2007-252.htm","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9689","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=177331","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-7108","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-224c-qxxc-fqx7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2006-7108","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2007:0235","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=169299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=177331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=187370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=188099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=197768","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0235.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-7108","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1618255","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-7108","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2006-7108","description":"login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.","status":"published","published":"2007-03-04T22:00:00Z","modified":"2024-08-07T20:50:06.039Z","updated_at":"2026-11-02T14:33:52.224925Z"}],"euvd":[{"id":"EUVD-2006-7090","description":"login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.","status":"published","published":"2007-03-04T22:00:00Z","modified":"2024-08-07T20:50:06Z","updated_at":"2026-11-03T01:15:40.702316Z"}],"ghsa":[{"id":"GHSA-224c-qxxc-fqx7","title":"login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such...","description":"login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.","status":"published","published":"2022-05-01T07:44:46Z","modified":"2023-01-31T05:03:12Z","updated_at":"2026-11-02T14:48:25.047764Z"}],"nvd":[{"id":"CVE-2006-7108","description":"login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.","status":"published","published":"2007-03-04T22:19:00Z","modified":"2026-06-16T22:34:23.79Z","cvss":[{"version":"2.0","score":4.1,"vector":"AV:L/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:01:10.726159Z"}],"osv":[{"id":"CVE-2006-7108","description":"login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.","status":"published","published":"2007-03-04T22:19:00Z","modified":"2026-04-10T03:38:38.281533Z","updated_at":"2026-11-02T15:43:56.865964Z"},{"id":"DEBIAN-CVE-2006-7108","description":"login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos krlogin session has been established, which might allow users to bypass intended access policies that would be enforced by pam_acct_mgmt and chauth_tok.","status":"published","published":"2007-03-04T22:19:00Z","modified":"2026-10-22T23:47:22.131993474Z","updated_at":"2026-11-02T15:45:23.105674Z"},{"id":"RHSA-2007:0235","title":"Red Hat Security Advisory: util-linux security and bug fix update","status":"published","published":"2024-09-15T16:31:49Z","modified":"2026-06-26T10:06:07Z","updated_at":"2026-11-02T15:52:59.70892Z"}]}}