crontab in Vixie cron 4.1, when running with the -e option, allows local users to read the cron files of other users by changing the file being edited to a symlink. NOTE: there is insufficient information to know whether this is a duplicate of CVE-2001-0235.

An updated vixie-cron package that fixes various bugs and a security issue is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times.

A bug was found in the way vixie-cron installs new crontab files. It is possible for a local attacker to execute the crontab command in such a way that they can view the contents of another user's crontab file. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1038 to this issue.

Additionally, this update addresses the following issues :

o Fixed improper limits on filename and command line lengths o Improved PAM access control conforming to EAL certification requirements o Improved reliability when running in a chroot environment o Mail recipient name checking disabled by default, can be re-enabled o Added '-p' 'permit all crontabs' option to disable crontab mode checking

All users of vixie-cron should upgrade to this updated package, which contains backported patches and is not vulnerable to these issues.

By setting hard links to /etc/crontab users were able to prevent cron from running scheduled jobs. (CVE-2007-1856)

A re-emerged symlink bug allowed users to edit the crontab of other users. (CVE-2005-1038)

This is a reissue of the SLES10 update after Service Pack 1, since Service Pack 1 merge lost some of the fixes in the cron package.

By setting hard links to /etc/crontab users were able to prevent cron from running scheduled jobs. (CVE-2007-1856)

A re-emerged symlink bug allowed users to edit the crontab of other users. (CVE-2005-1038)

By setting hard links to /etc/crontab users were able to prevent cron from running scheduled jobs (CVE-2007-1856).

A re-emerged symlink bug allowed users to edit the crontab of other users (CVE-2005-1038).

An updated vixie-cron package that fixes a bug and security issue is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times.

A bug was found in the way vixie-cron installs new crontab files. It is possible for a local attacker to execute the crontab command in such a way that they can view the contents of another user's crontab file. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1038 to this issue.

This update also fixes an issue where cron jobs could start before their scheduled time.

All users of vixie-cron should upgrade to this updated package, which contains backported patches and is not vulnerable to these issues.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:361 advisory.

    The vixie-cron package contains the Vixie version of cron. Cron is a     standard UNIX daemon that runs specified programs at scheduled times.

    A bug was found in the way vixie-cron installs new crontab files. It is     possible for a local attacker to execute the crontab command in such a way     that they can view the contents of another user's crontab file. The Common     Vulnerabilities and Exposures project assigned the name CAN-2005-1038 to     this issue.

    Additionally, this update addresses the following issues:

    o Fixed improper limits on filename and command line lengths     o Improved PAM access control conforming to EAL certification requirements     o Improved reliability when running in a chroot environment     o Mail recipient name checking disabled by default, can be re-enabled     o Added '-p' permit all crontabs option to disable crontab mode checking

    All users of vixie-cron should upgrade to this updated package, which     contains backported patches and is not vulnerable to these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
67026	CentOS 4 : vixie-cron (CESA-2005:361)	Nessus	CentOS Local Security Checks	low
29408	SuSE 10 Security Update : cron (ZYPP Patch Number 3831)	Nessus	SuSE Local Security Checks	low
29407	SuSE 10 Security Update : cron (ZYPP Patch Number 3093)	Nessus	SuSE Local Security Checks	low
27190	openSUSE 10 Security Update : cron (cron-3092)	Nessus	SuSE Local Security Checks	low
21880	CentOS 3 : vixie-cron (CESA-2006:0117)	Nessus	CentOS Local Security Checks	low
21088	RHEL 3 : vixie-cron (RHSA-2006:0117)	Nessus	Red Hat Local Security Checks	low
19987	RHEL 4 : vixie-cron (RHSA-2005:361)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2005-1038

medium

Tenable Plugins

low

low

low

low

low

low

medium