CVE-2012-2653 | Vulnerability Database | Aqua Security

arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.

Affected Software

Name	Vendor	Start Version	End Version
Arpwatch	Lawrence_berkeley_national_laboratory	2.1a15 (including)	2.1a15 (including)
Arpwatch	Ubuntu	hardy	*
Arpwatch	Ubuntu	lucid	*
Arpwatch	Ubuntu	natty	*
Arpwatch	Ubuntu	oneiric	*
Arpwatch	Ubuntu	precise	*
Arpwatch	Ubuntu	upstream	*

References

http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082553.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082565.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082569.html
http://www.debian.org/security/2012/dsa-2481
http://www.mandriva.com/security/advisories?name=MDVSA-2012:113
http://www.openwall.com/lists/oss-security/2012/05/24/12
http://www.openwall.com/lists/oss-security/2012/05/24/13
http://www.openwall.com/lists/oss-security/2012/05/24/14
http://www.openwall.com/lists/oss-security/2012/05/25/5
https://security.gentoo.org/glsa/201607-16

NVD	https://nvd.nist.gov/vuln/detail/CVE-2012-2653
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html