Description
Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.
References
- [cygwin-announce] 20160411 Cygwin 2.5.0-1 mailing-list
- [cygwin-announce] 20160419 CVE-2016-3067: network privilege escalation in Cygwin set(e)ui mailing-list
- [cygwin] 20160208 Possible Security Hole in SSHD w/ CYGWIN? mailing-list
- [cygwin-announce] 20160218 TEST RELEASE: Cygwin 2.5.0-0.4 mailing-list
- https://sourceware.org/git/?p=newlib-cygwin.git%3Ba=commit%3Bh=205862ed08649df8f50b926a2c58c963f571b044