Description
arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | arpwatch | 2.1a15-1.2 | — |
| Debian 13 | arpwatch | 2.1a15-1.2 | — |
| Debian 12 | arpwatch | 2.1a15-1.2 | — |
| Debian 6.0 | arpwatch | 2.1a15-1.1+squeeze1 | DSA-2481-1 |
Advisories 1
- DSA-2481-1 arpwatch - fails to drop supplementary groups Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20120525 Re: CVE Request: powerdns does not clear supplementary groups mailing-list
- FEDORA-2012-8675 vendor-advisory
- [oss-security] 20120525 Re: CVE Request: powerdns does not clear supplementary groups mailing-list
- [oss-security] 20120524 Re: CVE Request: powerdns does not clear supplementary groups mailing-list
- DSA-2481 vendor-advisory
- [oss-security] 20120524 Re: CVE Request: powerdns does not clear supplementary groups mailing-list
- MDVSA-2012:113 vendor-advisory
- FEDORA-2012-8702 vendor-advisory
- FEDORA-2012-8677 vendor-advisory
- GLSA-201607-16 vendor-advisory