CVE-2006-1376

NameCVE-2006-1376
DescriptionThe installation of Debian GNU/Linux 3.1r1 from the network install CD creates /var/log/debian-installer/cdebconf with world writable permissions, which allows local users to cause a denial of service (disk consumption).
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs254068, 356939, 358210

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
shadow (PTS)jessie, jessie (lts)1:4.2-3+deb8u5fixed
stretch (security)1:4.4-4.1+deb9u1fixed
stretch (lts), stretch1:4.4-4.1+deb9u2fixed
buster, buster (lts)1:4.5-1.1+deb10u1fixed
bullseye1:4.8.1-1fixed
bookworm1:4.13+dfsg1-1fixed
sid, trixie1:4.16.0-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
base-configsourcesarge(not affected)
base-configsource(unstable)2.68low254068
shadowsourcesarge1:4.0.3-31sarge8
shadowsource(unstable)1:4.0.14-9356939, 358210

Notes

The installer is fixed separately, but the postinst of the shadow update
corrects permissions of a faulty install

Search for package or bug name: Reporting problems