CVE-2012-2653

arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
10 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:C/A:C
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
VendorProductVersion
lawrence_berkeley_national_laboratoryarpwatch
2.1a15:a15
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
arpwatch
bookworm
2.1a15-8
fixed
bullseye
2.1a15-8
fixed
sid
2.1a15-9
fixed
trixie
2.1a15-9
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
arpwatch
precise
Fixed 2.1a15-1.1+squeeze1build0.12.04.1
released
oneiric
Fixed 2.1a15-1.1+squeeze1build0.11.10.1
released
natty
Fixed 2.1a15-1.1+squeeze1build0.11.04.1
released
lucid
Fixed 2.1a15-1.1+squeeze1build0.10.04.1
released
hardy
ignored
References
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082553.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082565.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082569.html
http://www.debian.org/security/2012/dsa-2481
http://www.mandriva.com/security/advisories?name=MDVSA-2012:113
http://www.openwall.com/lists/oss-security/2012/05/24/12
http://www.openwall.com/lists/oss-security/2012/05/24/13
http://www.openwall.com/lists/oss-security/2012/05/24/14
http://www.openwall.com/lists/oss-security/2012/05/25/5
https://security.gentoo.org/glsa/201607-16
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082553.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082565.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082569.html
http://www.debian.org/security/2012/dsa-2481
http://www.mandriva.com/security/advisories?name=MDVSA-2012:113
http://www.openwall.com/lists/oss-security/2012/05/24/12
http://www.openwall.com/lists/oss-security/2012/05/24/13
http://www.openwall.com/lists/oss-security/2012/05/24/14
http://www.openwall.com/lists/oss-security/2012/05/25/5
https://security.gentoo.org/glsa/201607-16