CVE-request: monkey fails to drop supplemental groups when lowering privileges

[Henri Salo <henri () nerv fi>]

Hello,

Please assign 2012 CVE-identifier for following monkey vulnerability:

Monkey webserver fails to drop supplemental groups when lowering privileges. This allows any local user on the system 
to read any fine that root's supplemental groups can access. Monkey does perform a filesystem access check to make sure 
that its EUID/EGID can access the target file, but this check is subject to TOCTOU flaws.

Reported by John Lightsey in http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688007
Affected Debian-version is 0.9.3-1 (haven't tested upstream package)
Project page: http://www.monkey-project.com/

- Henri Salo