CVE-2006-1844
2.1 · LOWThe Debian installer for the (1) shadow 4.0.14 and (2) base-config 2.53.10 packages includes sensitive information in world-readable log files, including preseeded passwords and pppoeconf passwords…
Overview
CVE-2006-1844 is a low-severity vulnerability affecting debian base-config. It was published on April 19, 2006 and has a CVSS 2.0 base score of 2.1 (LOW).
This vulnerability has a CVSS 2.0 base score of 2.1, rated LOW. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.
Technical description
The Debian installer for the (1) shadow 4.0.14 and (2) base-config 2.53.10 packages includes sensitive information in world-readable log files, including preseeded passwords and pppoeconf passwords, which might allow local users to gain privileges.
Remediation
Check the references section for vendor advisories and patches from debian. Update base-config to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected products
| Vendor | Product | Versions | Status |
|---|
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-2006-1844?
CVE-2006-1844 is a low-severity vulnerability affecting debian base-config. It was published on April 19, 2006 and has a CVSS 2.0 base score of 2.1 (LOW).
How severe is CVE-2006-1844?
This vulnerability has a CVSS 2.0 base score of 2.1, rated LOW. It requires local or adjacent network access to exploit. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2006-1844?
Check the references section for vendor advisories and patches from debian. Update base-config to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2006-1844?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2006-1844 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related LOW CVEs from 2006
View all- 3.7CVE-2006-1166
Monotone 0.25 and earlier, when a user creates a file in a directory called "mt", and when checking
View details - 3.7CVE-2006-1198
Comvigo IM Lock 2006 uses a simple substitution cipher to encrypt a password stored in the msnvs\prc
View details - 3.7CVE-2006-1335
gnome screensaver before 2.14, when running on an X server with AllowDeactivateGrabs and AllowClosed
View details - 3.7CVE-2006-1542
Stack-based buffer overflow in Python 2.4.2 and earlier, running on Linux 2.6.12.5 under gcc 4.0.3 w
View details - 3.7CVE-2006-1830
Sun Java Studio Enterprise 8, when installed as root, creates certain files with world-writable perm
View details - 3.7CVE-2006-1057
Race condition in daemon/slave.c in gdm before 2.14.1 allows local users to gain privileges via a sy
View details - 3.7CVE-2006-2035
Websense, when configured to permit access to the dynamic content category, allows local users to by
View details - 3.7CVE-2006-1174
useradd in shadow-utils before 4.0.3, and possibly other versions before 4.0.8, does not provide a r
View details - 3.7CVE-2006-2452
GNOME GDM 2.8, 2.12, 2.14, and 2.15, when the "face browser" feature is enabled, allows local users
View details - 3.7CVE-2006-4886
The VirusScan On-Access Scan component in McAfee VirusScan Enterprise 7.1.0 and Scan Engine 4.4.00 a
View details - 3.7CVE-2006-4393
Unspecified vulnerability in LoginWindow in Apple Mac OS X 10.4 through 10.4.7, when Fast User Switc
View details - 3.6CVE-2006-0133
Multiple directory traversal vulnerabilities in AIX 5.3 ML03 allow local users to determine the exis
View details