CVE-2012-2653

EUVD-2012-2639
arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:C/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
Affected Products (NVD)
VendorProductVersion
lawrence_berkeley_national_laboratoryarpwatch
2.1a15:a15
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
arpwatch
bookworm
2.1a15-8
fixed
bullseye
2.1a15-8
fixed
sid
2.1a15-9
fixed
trixie
2.1a15-9
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
arpwatch
hardy
ignored
lucid
Fixed 2.1a15-1.1+squeeze1build0.10.04.1
released
natty
Fixed 2.1a15-1.1+squeeze1build0.11.04.1
released
oneiric
Fixed 2.1a15-1.1+squeeze1build0.11.10.1
released
precise
Fixed 2.1a15-1.1+squeeze1build0.12.04.1
released
References
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082553.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082565.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082569.html
http://www.debian.org/security/2012/dsa-2481
http://www.mandriva.com/security/advisories?name=MDVSA-2012:113
http://www.openwall.com/lists/oss-security/2012/05/24/12
http://www.openwall.com/lists/oss-security/2012/05/24/13
http://www.openwall.com/lists/oss-security/2012/05/24/14
http://www.openwall.com/lists/oss-security/2012/05/25/5
https://security.gentoo.org/glsa/201607-16
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082553.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082565.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082569.html
http://www.debian.org/security/2012/dsa-2481
http://www.mandriva.com/security/advisories?name=MDVSA-2012:113
http://www.openwall.com/lists/oss-security/2012/05/24/12
http://www.openwall.com/lists/oss-security/2012/05/24/13
http://www.openwall.com/lists/oss-security/2012/05/24/14
http://www.openwall.com/lists/oss-security/2012/05/25/5
https://security.gentoo.org/glsa/201607-16