NVD Vulnerability Detail

CVE-2012-2653

Summary	arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.
Publication Date	July 13, 2012, 5:55 a.m.
Registration Date	Jan. 28, 2021, 2:58 p.m.
Last Update	Nov. 21, 2024, 10:39 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:lawrence_berkeley_national_laboratory:arpwatch:2.1a15:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082553.html
2	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082553.html
3	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082565.html
4	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082565.html
5	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082569.html
6	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082569.html
7	http://www.debian.org/security/2012/dsa-2481
8	http://www.debian.org/security/2012/dsa-2481
9	http://www.mandriva.com/security/advisories?name=MDVSA-2012:113
10	http://www.mandriva.com/security/advisories?name=MDVSA-2012:113
11	http://www.openwall.com/lists/oss-security/2012/05/24/12
12	http://www.openwall.com/lists/oss-security/2012/05/24/12
13	http://www.openwall.com/lists/oss-security/2012/05/24/13
14	http://www.openwall.com/lists/oss-security/2012/05/24/13
15	http://www.openwall.com/lists/oss-security/2012/05/24/14
16	http://www.openwall.com/lists/oss-security/2012/05/24/14
17	http://www.openwall.com/lists/oss-security/2012/05/25/5
18	http://www.openwall.com/lists/oss-security/2012/05/25/5
19	https://security.gentoo.org/glsa/201607-16
20	https://security.gentoo.org/glsa/201607-16

Common Vulnerabilities List

JVN Vulnerability Information

arpwatch における root 権限を取得される脆弱性

Title	arpwatch における root 権限を取得される脆弱性
Summary	複数の Linux ディストリビューションで使用される arpwatch は、適切に補助グループを削除しないため、root 権限を取得される脆弱性が存在します。
Possible impacts	攻撃者により、デーモンの他の脆弱性を悪用されて、root 権限を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	July 12, 2012, midnight
Registration Date	July 17, 2012, 4:26 p.m.
Last Update	July 17, 2012, 4:26 p.m.

Affected System

Lawrence Berkeley National Laboratory

arpwatch 2.1a15

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-2653	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2653
National Vulnerability Database (NVD)
2	CVE-2012-2653	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-2653

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-DesignError	https://www.ipa.go.jp/security/vuln/CWE.html#CWEDesignError

ベンダー情報

No	Name	URL
Debian セキュリティ勧告
1	DSA-2481	http://www.debian.org/security/2012/dsa-2481
Fedora Update Notification
2	FEDORA-2012-8675	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082569.html
3	FEDORA-2012-8677	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082553.html
4	FEDORA-2012-8702	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082565.html
Lawrence Berkeley National Laboratory
5	LBNL's Network Research Group	http://ee.lbl.gov/

Change Log

No	Changed Details	Date of change
0	[2012年07月17日] 掲載	Feb. 17, 2018, 10:37 a.m.