CVE-2009-3589: incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, whic...

Security readout for executives and security teams

CVE-2009-3589 is a local privilege escalation issue in incron 0.5.5. When a user's incrontab runs a process, incron may leave the daemon's supplementary groups in place, giving that process unintended group privileges. Likely limited to systems running incron 0.5.5 where local users can create or control incrontab entries. The provided sources do not establish a full affected product or distribution matrix. Treat as a targeted local privilege risk on older systems, not an internet-scale emergency. Prioritize shared servers, multi-user Linux hosts, and environments where local user compromise could lead to broader access. Mitigation focus: Check vendor package guidance for incron updates addressing CVE-2009-3589.; Upgrade incron where a fixed package is available from your distribution.; Restrict incrontab access to trusted local users until remediation is complete..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.