CVE-2009-3589 incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users t...
MediumCVSS 4.6
EPSS 0.30%
- Published
- Updated
- Exploit status
- No public exploit known
Description
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| inotify incron | = 0.5.5 | No fix listed |
| debian/incron(Debian:12) | < 0.5.7-1 | 0.5.7-1 |
| debian/incron(Debian:13) | < 0.5.7-1 | 0.5.7-1 |
| debian/incron(Debian:14) | < 0.5.7-1 | 0.5.7-1 |
References
- koji.fedoraproject.org patch
- admin.fedoraproject.org
- Debian Security Tracker CVE-2009-3589 vendor-advisory