do_command.c in Vixie cron (vixie-cron) 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in /etc/security/limits.conf.

It was discovered that cron did not properly check the return code of the setgid() and initgroups() system calls. A local attacker could use this to escalate group privileges. Please note that cron versions 3.0pl1-64 and later were already patched to address the more serious setuid() check referred to by CVE-2006-2607.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A missing check on the return value of setuid() in vixie-cron could be used by a local user to gain root privileges by exhausting resource limits and waiting for a cronjob to trigger. This is tracked by the Mitre CVE ID CVE-2006-2607.

Updated vixie-cron packages that fix a privilege escalation issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times.

A privilege escalation flaw was found in the way Vixie Cron runs programs; vixie-cron does not properly verify an attempt to set the current process user id succeeded. It was possible for a malicious local users who exhausted certain limits to execute arbitrary commands as root via cron. (CVE-2006-2607)

All users of vixie-cron should upgrade to these updated packages, which contain a backported patch to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200606-07 (Vixie Cron: Privilege Escalation)

    Roman Veretelnikov discovered that Vixie Cron fails to properly     check whether it can drop privileges accordingly if setuid() in     do_command.c fails due to a user exceeding assigned resource limits.
  Impact :

    Local users can execute code with root privileges by deliberately     exceeding their assigned resource limits and then starting a command     through Vixie Cron. This requires resource limits to be in place on the     machine.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
38984	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : cron vulnerability (USN-778-1)	Nessus	Ubuntu Local Security Checks	high
27189	openSUSE 10 Security Update : cron (cron-1440)	Nessus	SuSE Local Security Checks	high
22043	RHEL 4 : vixie-cron (RHSA-2006:0539)	Nessus	Red Hat Local Security Checks	high
22036	CentOS 4 : vixie-cron (CESA-2006:0539)	Nessus	CentOS Local Security Checks	high
21680	GLSA-200606-07 : Vixie Cron: Privilege Escalation	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2006-2607

high

Tenable Plugins

high

high

high

high

high