Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.6
CVE-2009-3589: Incron can give user scripts extra group privileges
CVE-2009-3589 · published 17 years ago
Summary
When incron runs a command from a user’s watch list, it fails to reset the extra permission groups, so the command inherits the groups that belong to the incron service. This can let a local user gain additional rights on the system. Upgrade to a newer incron release or apply the available patch, and limit or review any incron watch entries.
What to do
- Update debian incron to version 0.5.7-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | incron |
< 0.5.7-1 Fix: upgrade to 0.5.7-1
|
| Debian:13 | debian | incron |
< 0.5.7-1 Fix: upgrade to 0.5.7-1
|
| Debian:14 | debian | incron |
< 0.5.7-1 Fix: upgrade to 0.5.7-1
|
| – | inotify | incron |
0.5.5 cpe:2.3:a:inotify:incron:0.5.5:*:*:*:*:*:*:* |
Original advisory text
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local user...
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
Severity
4.6
Medium
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published8 Oct 2009
Updated3 Nov 2026
First seen17 Sep 2026
Track software like this
Free during beta