CVE-2012-4442

Summary: CVE-2012-4442 affects Monkey HTTP Daemon 0.9.3. The issue arises because the daemon retains the supplementary group IDs of the root account while operating with a non-root effective UID, which could allow local users to bypass file-read restrictions due to a race condition in a file-perm...

CVE-2012-5303

Monkey HTTP Daemon 0.9.3 is vulnerable to a local file overwrite via a symlink attack on its PID file. The issue is a race condition that can occur when a pathname different from the default /var/run/monkey.pid is used, allowing local users to trick the daemon into overwriting arbitrary files. Im...

CVE-2012-4443

CVE-2012-4443 affects Monkey HTTP Daemon 0.9.3. The issue stems from the daemon executing CGI scripts with real UID/GID of root, enabling local users to potentially gain privileges by exploiting write access to cgi-bin. This is a local-privilege-escalation path described in multiple sources. No r...