#VU33951 Input validation error in arpwatch - CVE-2012-2653 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33951

#VU33951 Input validation error in arpwatch - CVE-2012-2653

Published: July 12, 2012 / Updated: August 4, 2020


Vulnerability identifier: #VU33951
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2012-2653
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
arpwatch
Software vendor:
LBNL\'s Network Research Group

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.


Remediation

Install update from vendor's website.

External links