CVE-2006-6683: Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that process

Q: How do I fix CVE-2006-6683?

chetcpasswd: upgrade to newer than 2.4.1. Exact commands for each OS are on this page.

Q: Is CVE-2006-6683 being exploited?

CVE-2006-6683 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2006-6683 affect?

CVE-2006-6683 affects chetcpasswd. Severity is high (CVSS 7.8). Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions imple

This month

HIGH 7.8UPGRADE

CVE-2006-6683 is a high-severity flaw (CVSS 7.8) affecting chetcpasswd. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions implemented through PAM.

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	7.8 (High)
EPSS exploit chance	1.4% (top 27%)
CISA exploited list	No
Weakness	CWE-264
Published	2006-12-21
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: pedro lineu orso

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2006-12-21 19:28 UTCPublished CVE record published
2026-06-16 22:33 UTCUpdated Record last modified

pedro lineu orso chetcpasswd UPGRADE

Affected: <= 2.4.1 · 1.12 · 2.1 · 2.2.1 · 2.3.1 · 2.3.3

Fixed in: newer than 2.4.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy chetcpasswd || rpm -q chetcpasswd || chetcpasswd --version

2. UPGRADE to newer than 2.4.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade chetcpasswd

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade chetcpasswd

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2006-6683?

chetcpasswd: upgrade to newer than 2.4.1. Exact commands for each OS are on this page.

Is CVE-2006-6683 being exploited?

CVE-2006-6683 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2006-6683 affect?

CVE-2006-6683 affects chetcpasswd. Severity is high (CVSS 7.8). Pedro Lineu Orso chetcpasswd 2.4.1 and earlier verifies and updates user accounts via custom code that processes /etc/shadow and does not follow the PAM configuration, which might allow remote attackers to bypass intended restrictions imple

How urgent is CVE-2006-6683?

Priority 46/100. High severity

Related CVEs

CVE-2006-6685 HIGH 7.2 DOWNGRADE Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd 2.3.3 allows local users to cause a denial of servi
CVE-2006-6684 HIGH 7.5 UPGRADE Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd before 2.4 allows remote attackers to cause a denia
CVE-2006-6682 MEDIUM 5.0 DOWNGRADE Pedro Lineu Orso chetcpasswd 2.3.3 provides a different error message when a request with a valid username fai
CVE-2006-6681 HIGH 7.5 DOWNGRADE Pedro Lineu Orso chetcpasswd 2.3.3 does not have a rate limit for client requests, which might allow remote at
CVE-2006-6680 MEDIUM 4.6 DOWNGRADE Pedro Lineu Orso chetcpasswd before 2.3.1 does not document the need for 0400 permissions on /etc/chetcpasswd.

References

← Back to latest CVEs