CVE-2006-6680: Pedro Lineu Orso chetcpasswd before 2.3.1 does not document the need for 0400 permissions on /etc/chetcpass...

Security readout for executives and security teams

This is a local information-disclosure issue in chetcpasswd before 2.3.1. The documented problem is not a remote break-in; it is that required restrictive permissions for /etc/chetcpasswd.allow were not documented, so local users may be able to read sensitive authorization information if the file is too open. Exposure is limited to systems running chetcpasswd before 2.3.1 where /etc/chetcpasswd.allow exists and is readable by local non-privileged users. The affected inventory in the bundle is incomplete and lists vendor/product as n/a. Treat this as a low-urgency hygiene issue unless chetcpasswd is present on shared Unix-like systems with many local users. The business risk is sensitive local configuration exposure, not known remote compromise. Mitigation focus: Check vendor release notes and guidance for chetcpasswd 2.3.1 or later.; Restrict /etc/chetcpasswd.allow permissions to 0400 where vendor guidance requires it.; Limit local shell access to systems using chetcpasswd..

Prepared

Jun 29, 2026, 08:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.