CVE-2012-4442 : Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effec

Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID, which might allow local users to bypass intended file-read restrictions by leveraging a race condition in a file-permission check.

Published 2012-10-05 21:55:01

Updated 2020-03-26 14:24:04

Source Red Hat, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2012-4442

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2012-4442

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.7	MEDIUM	AV:L/AC:M/Au:N/C:C/I:N/A:N	3.4	6.9	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: None Availability Impact: None

References for CVE-2012-4442

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688879

#688879 - RM: monkey -- RoQA; unmaintained, RC buggy, outdated, alternatives exist - Debian Bug report logs

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2012/09/21/3

oss-security - Re: CVE-request: monkey fails to drop supplemental groups when lowering privileges
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688007

#688007 - monkey: CVE-2012-4442: Fails to drop supplemental groups when lowering privileges - Debian Bug report logs

Products affected by CVE-2012-4442

Monkey-project » Monkey » Version: 0.9.3
cpe:2.3:a:monkey-project:monkey:0.9.3:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2012-4442

Exploit prediction scoring system (EPSS) score for CVE-2012-4442

CVSS scores for CVE-2012-4442

CWE ids for CVE-2012-4442

References for CVE-2012-4442

Products affected by CVE-2012-4442