CVE-2012-2653

2012-07-1200:00:00

ubuntu.com

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.011 Low

EPSS

Percentile

84.6%

JSON

arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others,
does not properly drop supplementary groups, which might allow attackers to
gain root privileges by leveraging other vulnerabilities in the daemon.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=674715>

Notes

Author	Note
tyhicks	Per Debian BTS, “Found in version arpwatch/2.1a15-1.1”

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarcharpwatch< 2.1a15-1.1+squeeze1build0.10.04.1UNKNOWN
ubuntu11.04noarcharpwatch< 2.1a15-1.1+squeeze1build0.11.04.1UNKNOWN
ubuntu11.10noarcharpwatch< 2.1a15-1.1+squeeze1build0.11.10.1UNKNOWN
ubuntu12.04noarcharpwatch< 2.1a15-1.1+squeeze1build0.12.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	arpwatch	< 2.1a15-1.1+squeeze1build0.10.04.1	UNKNOWN
ubuntu	11.04	noarch	arpwatch	< 2.1a15-1.1+squeeze1build0.11.04.1	UNKNOWN
ubuntu	11.10	noarch	arpwatch	< 2.1a15-1.1+squeeze1build0.11.10.1	UNKNOWN
ubuntu	12.04	noarch	arpwatch	< 2.1a15-1.1+squeeze1build0.12.04.1	UNKNOWN