CVE-2016-3067 Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.
CriticalCVSS 9.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cygwin | <= 2.4.1-1 | No fix listed |
References
- [cygwin-announce] 20160218 TEST RELEASE: Cygwin 2.5.0-0.4 mailing-list release-notes vendor-advisory
- [cygwin-announce] 20160411 Cygwin 2.5.0-1 mailing-list release-notes vendor-advisory
- [cygwin-announce] 20160419 CVE-2016-3067: network privilege escalation in Cygwin set(e)ui mailing-list release-notes vendor-advisory
- [cygwin] 20160208 Possible Security Hole in SSHD w/ CYGWIN? mailing-list release-notes vendor-advisory
- sourceware.org