rhsa-2012_0304
Vulnerability from csaf_redhat
Published
2012-02-21 02:21
Modified
2024-11-22 04:44
Summary
Red Hat Security Advisory: vixie-cron security, bug fix, and enhancement update

Notes

Topic
An updated vixie-cron package that fixes one security issue, several bugs, and adds one enhancement is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times. The vixie-cron package adds improved security and more powerful configuration options to the standard version of cron. A race condition was found in the way the crontab program performed file time stamp updates on a temporary file created when editing a user crontab file. A local attacker could use this flaw to change the modification time of arbitrary system files via a symbolic link attack. (CVE-2010-0424) Red Hat would like to thank Dan Rosenberg for reporting this issue. This update also fixes the following bugs: * Cron jobs of users with home directories mounted on a Lightweight Directory Access Protocol (LDAP) server or Network File System (NFS) were often refused because jobs were marked as orphaned (typically due to a temporary NSS lookup failure, when NIS and LDAP servers were unreachable). With this update, a database of orphans is created, and cron jobs are performed as expected. (BZ#455664) * Previously, cron did not log any errors if a cron job file located in the /etc/cron.d/ directory contained invalid entries. An upstream patch has been applied to address this problem and invalid entries in the cron job files now produce warning messages. (BZ#460070) * Previously, the "@reboot" crontab macro incorrectly ran jobs when the crond daemon was restarted. If the user used the macro on multiple machines, all entries with the "@reboot" option were executed every time the crond daemon was restarted. With this update, jobs are executed only when the machine is rebooted. (BZ#476972) * The crontab utility is now compiled as a position-independent executable (PIE), which enhances the security of the system. (BZ#480930) * When the parent crond daemon was stopped, but a child crond daemon was running (executing a program), the "service crond status" command incorrectly reported that crond was running. The source code has been modified, and the "service crond status" command now correctly reports that crond is stopped. (BZ#529632) * According to the pam(8) manual page, the cron daemon, crond, supports access control with PAM (Pluggable Authentication Module). However, the PAM configuration file for crond did not export environment variables correctly and, consequently, setting PAM variables via cron did not work. This update includes a corrected /etc/pam.d/crond file that exports environment variables correctly. Setting pam variables via cron now works as documented in the pam(8) manual page. (BZ#541189) * Previously, the mcstransd daemon modified labels for the crond daemon. When the crond daemon attempted to use the modified label and mcstransd was not running, crond used an incorrect label. Consequently, Security-Enhanced Linux (SELinux) denials filled up the cron log, no jobs were executed, and crond had to be restarted. With this update, both mcstransd and crond use raw SELinux labels, which prevents the problem. (BZ#625016) * Previously, the crontab(1) and cron(8) manual pages contained multiple typographical errors. This update fixes those errors. (BZ#699620, BZ#699621) In addition, this update adds the following enhancement: * Previously, the crontab utility did not use the Pluggable Authentication Module (PAM) for verification of users. As a consequence, a user could access crontab even if access had been restricted (usually by being denied in the access.conf file). With this update, crontab returns an error message that the user is not allowed to access crontab because of PAM configuration. (BZ#249512) All vixie-cron users should upgrade to this updated package, which resolves these issues and adds this enhancement.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated vixie-cron package that fixes one security issue, several bugs,\nand adds one enhancement is now available for Red Hat Enterprise Linux 5.\n\nThe Red Hat Security Response Team has rated this update as having low\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The vixie-cron package contains the Vixie version of cron. Cron is a\nstandard UNIX daemon that runs specified programs at scheduled times. The\nvixie-cron package adds improved security and more powerful configuration\noptions to the standard version of cron.\n\nA race condition was found in the way the crontab program performed file\ntime stamp updates on a temporary file created when editing a user crontab\nfile. A local attacker could use this flaw to change the modification time\nof arbitrary system files via a symbolic link attack. (CVE-2010-0424)\n\nRed Hat would like to thank Dan Rosenberg for reporting this issue.\n\nThis update also fixes the following bugs:\n\n* Cron jobs of users with home directories mounted on a Lightweight\nDirectory Access Protocol (LDAP) server or Network File System (NFS) were\noften refused because jobs were marked as orphaned (typically due to a\ntemporary NSS lookup failure, when NIS and LDAP servers were unreachable).\nWith this update, a database of orphans is created, and cron jobs are\nperformed as expected. (BZ#455664)\n\n* Previously, cron did not log any errors if a cron job file located in the\n/etc/cron.d/ directory contained invalid entries. An upstream patch has\nbeen applied to address this problem and invalid entries in the cron job\nfiles now produce warning messages. (BZ#460070)\n\n* Previously, the \"@reboot\" crontab macro incorrectly ran jobs when the\ncrond daemon was restarted. If the user used the macro on multiple\nmachines, all entries with the \"@reboot\" option were executed every time\nthe crond daemon was restarted. With this update, jobs are executed only\nwhen the machine is rebooted. (BZ#476972)\n\n* The crontab utility is now compiled as a position-independent executable\n(PIE), which enhances the security of the system. (BZ#480930)\n\n* When the parent crond daemon was stopped, but a child crond daemon was\nrunning (executing a program), the \"service crond status\" command\nincorrectly reported that crond was running. The source code has been\nmodified, and the \"service crond status\" command now correctly reports that\ncrond is stopped. (BZ#529632)\n\n* According to the pam(8) manual page, the cron daemon, crond, supports\naccess control with PAM (Pluggable Authentication Module). However, the PAM\nconfiguration file for crond did not export environment variables correctly\nand, consequently, setting PAM variables via cron did not work. This update\nincludes a corrected /etc/pam.d/crond file that exports environment\nvariables correctly. Setting pam variables via cron now works as documented\nin the pam(8) manual page. (BZ#541189)\n\n* Previously, the mcstransd daemon modified labels for the crond daemon.\nWhen the crond daemon attempted to use the modified label and mcstransd was\nnot running, crond used an incorrect label. Consequently, Security-Enhanced\nLinux (SELinux) denials filled up the cron log, no jobs were executed, and\ncrond had to be restarted. With this update, both mcstransd and crond use\nraw SELinux labels, which prevents the problem. (BZ#625016)\n\n* Previously, the crontab(1) and cron(8) manual pages contained multiple\ntypographical errors. This update fixes those errors. (BZ#699620,\nBZ#699621)\n\nIn addition, this update adds the following enhancement:\n\n* Previously, the crontab utility did not use the Pluggable Authentication\nModule (PAM) for verification of users. As a consequence, a user could\naccess crontab even if access had been restricted (usually by being denied\nin the access.conf file). With this update, crontab returns an error\nmessage that the user is not allowed to access crontab because of PAM\nconfiguration. (BZ#249512)\n\nAll vixie-cron users should upgrade to this updated package, which resolves\nthese issues and adds this enhancement.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2012:0304",
        "url": "https://access.redhat.com/errata/RHSA-2012:0304"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "455664",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=455664"
      },
      {
        "category": "external",
        "summary": "460070",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=460070"
      },
      {
        "category": "external",
        "summary": "476972",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=476972"
      },
      {
        "category": "external",
        "summary": "480930",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=480930"
      },
      {
        "category": "external",
        "summary": "529632",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=529632"
      },
      {
        "category": "external",
        "summary": "541189",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=541189"
      },
      {
        "category": "external",
        "summary": "565809",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=565809"
      },
      {
        "category": "external",
        "summary": "625016",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=625016"
      },
      {
        "category": "external",
        "summary": "699620",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=699620"
      },
      {
        "category": "external",
        "summary": "699621",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=699621"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0304.json"
      }
    ],
    "title": "Red Hat Security Advisory: vixie-cron security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-22T04:44:03+00:00",
      "generator": {
        "date": "2024-11-22T04:44:03+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2012:0304",
      "initial_release_date": "2012-02-21T02:21:00+00:00",
      "revision_history": [
        {
          "date": "2012-02-21T02:21:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2012-02-21T02:24:41+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T04:44:03+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
                  "product_id": "5Client",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux (v. 5 server)",
                "product": {
                  "name": "Red Hat Enterprise Linux (v. 5 server)",
                  "product_id": "5Server",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vixie-cron-4:4.1-81.el5.src",
                "product": {
                  "name": "vixie-cron-4:4.1-81.el5.src",
                  "product_id": "vixie-cron-4:4.1-81.el5.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vixie-cron@4.1-81.el5?arch=src\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vixie-cron-4:4.1-81.el5.x86_64",
                "product": {
                  "name": "vixie-cron-4:4.1-81.el5.x86_64",
                  "product_id": "vixie-cron-4:4.1-81.el5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vixie-cron@4.1-81.el5?arch=x86_64\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vixie-cron-debuginfo-4:4.1-81.el5.x86_64",
                "product": {
                  "name": "vixie-cron-debuginfo-4:4.1-81.el5.x86_64",
                  "product_id": "vixie-cron-debuginfo-4:4.1-81.el5.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vixie-cron-debuginfo@4.1-81.el5?arch=x86_64\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vixie-cron-4:4.1-81.el5.i386",
                "product": {
                  "name": "vixie-cron-4:4.1-81.el5.i386",
                  "product_id": "vixie-cron-4:4.1-81.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vixie-cron@4.1-81.el5?arch=i386\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vixie-cron-debuginfo-4:4.1-81.el5.i386",
                "product": {
                  "name": "vixie-cron-debuginfo-4:4.1-81.el5.i386",
                  "product_id": "vixie-cron-debuginfo-4:4.1-81.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vixie-cron-debuginfo@4.1-81.el5?arch=i386\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vixie-cron-4:4.1-81.el5.ia64",
                "product": {
                  "name": "vixie-cron-4:4.1-81.el5.ia64",
                  "product_id": "vixie-cron-4:4.1-81.el5.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vixie-cron@4.1-81.el5?arch=ia64\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vixie-cron-debuginfo-4:4.1-81.el5.ia64",
                "product": {
                  "name": "vixie-cron-debuginfo-4:4.1-81.el5.ia64",
                  "product_id": "vixie-cron-debuginfo-4:4.1-81.el5.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vixie-cron-debuginfo@4.1-81.el5?arch=ia64\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ia64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vixie-cron-4:4.1-81.el5.ppc",
                "product": {
                  "name": "vixie-cron-4:4.1-81.el5.ppc",
                  "product_id": "vixie-cron-4:4.1-81.el5.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vixie-cron@4.1-81.el5?arch=ppc\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vixie-cron-debuginfo-4:4.1-81.el5.ppc",
                "product": {
                  "name": "vixie-cron-debuginfo-4:4.1-81.el5.ppc",
                  "product_id": "vixie-cron-debuginfo-4:4.1-81.el5.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vixie-cron-debuginfo@4.1-81.el5?arch=ppc\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vixie-cron-4:4.1-81.el5.s390x",
                "product": {
                  "name": "vixie-cron-4:4.1-81.el5.s390x",
                  "product_id": "vixie-cron-4:4.1-81.el5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vixie-cron@4.1-81.el5?arch=s390x\u0026epoch=4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vixie-cron-debuginfo-4:4.1-81.el5.s390x",
                "product": {
                  "name": "vixie-cron-debuginfo-4:4.1-81.el5.s390x",
                  "product_id": "vixie-cron-debuginfo-4:4.1-81.el5.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/vixie-cron-debuginfo@4.1-81.el5?arch=s390x\u0026epoch=4"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-4:4.1-81.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:vixie-cron-4:4.1-81.el5.i386"
        },
        "product_reference": "vixie-cron-4:4.1-81.el5.i386",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-4:4.1-81.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:vixie-cron-4:4.1-81.el5.ia64"
        },
        "product_reference": "vixie-cron-4:4.1-81.el5.ia64",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-4:4.1-81.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:vixie-cron-4:4.1-81.el5.ppc"
        },
        "product_reference": "vixie-cron-4:4.1-81.el5.ppc",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-4:4.1-81.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:vixie-cron-4:4.1-81.el5.s390x"
        },
        "product_reference": "vixie-cron-4:4.1-81.el5.s390x",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-4:4.1-81.el5.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:vixie-cron-4:4.1-81.el5.src"
        },
        "product_reference": "vixie-cron-4:4.1-81.el5.src",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-4:4.1-81.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:vixie-cron-4:4.1-81.el5.x86_64"
        },
        "product_reference": "vixie-cron-4:4.1-81.el5.x86_64",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-debuginfo-4:4.1-81.el5.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:vixie-cron-debuginfo-4:4.1-81.el5.i386"
        },
        "product_reference": "vixie-cron-debuginfo-4:4.1-81.el5.i386",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-debuginfo-4:4.1-81.el5.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:vixie-cron-debuginfo-4:4.1-81.el5.ia64"
        },
        "product_reference": "vixie-cron-debuginfo-4:4.1-81.el5.ia64",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-debuginfo-4:4.1-81.el5.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:vixie-cron-debuginfo-4:4.1-81.el5.ppc"
        },
        "product_reference": "vixie-cron-debuginfo-4:4.1-81.el5.ppc",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-debuginfo-4:4.1-81.el5.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:vixie-cron-debuginfo-4:4.1-81.el5.s390x"
        },
        "product_reference": "vixie-cron-debuginfo-4:4.1-81.el5.s390x",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-debuginfo-4:4.1-81.el5.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client:vixie-cron-debuginfo-4:4.1-81.el5.x86_64"
        },
        "product_reference": "vixie-cron-debuginfo-4:4.1-81.el5.x86_64",
        "relates_to_product_reference": "5Client"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-4:4.1-81.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:vixie-cron-4:4.1-81.el5.i386"
        },
        "product_reference": "vixie-cron-4:4.1-81.el5.i386",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-4:4.1-81.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:vixie-cron-4:4.1-81.el5.ia64"
        },
        "product_reference": "vixie-cron-4:4.1-81.el5.ia64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-4:4.1-81.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:vixie-cron-4:4.1-81.el5.ppc"
        },
        "product_reference": "vixie-cron-4:4.1-81.el5.ppc",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-4:4.1-81.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:vixie-cron-4:4.1-81.el5.s390x"
        },
        "product_reference": "vixie-cron-4:4.1-81.el5.s390x",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-4:4.1-81.el5.src as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:vixie-cron-4:4.1-81.el5.src"
        },
        "product_reference": "vixie-cron-4:4.1-81.el5.src",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-4:4.1-81.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:vixie-cron-4:4.1-81.el5.x86_64"
        },
        "product_reference": "vixie-cron-4:4.1-81.el5.x86_64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-debuginfo-4:4.1-81.el5.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:vixie-cron-debuginfo-4:4.1-81.el5.i386"
        },
        "product_reference": "vixie-cron-debuginfo-4:4.1-81.el5.i386",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-debuginfo-4:4.1-81.el5.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:vixie-cron-debuginfo-4:4.1-81.el5.ia64"
        },
        "product_reference": "vixie-cron-debuginfo-4:4.1-81.el5.ia64",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-debuginfo-4:4.1-81.el5.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:vixie-cron-debuginfo-4:4.1-81.el5.ppc"
        },
        "product_reference": "vixie-cron-debuginfo-4:4.1-81.el5.ppc",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-debuginfo-4:4.1-81.el5.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:vixie-cron-debuginfo-4:4.1-81.el5.s390x"
        },
        "product_reference": "vixie-cron-debuginfo-4:4.1-81.el5.s390x",
        "relates_to_product_reference": "5Server"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vixie-cron-debuginfo-4:4.1-81.el5.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server:vixie-cron-debuginfo-4:4.1-81.el5.x86_64"
        },
        "product_reference": "vixie-cron-debuginfo-4:4.1-81.el5.x86_64",
        "relates_to_product_reference": "5Server"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Dan Rosenberg"
          ]
        }
      ],
      "cve": "CVE-2010-0424",
      "discovery_date": "2010-02-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "565809"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The edit_cmd function in crontab.c in (1) cronie before 1.4.4 and (2) Vixie cron (vixie-cron) allows local users to change the modification times of arbitrary files, and consequently cause a denial of service, via a symlink attack on a temporary file in the /tmp directory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cronie: Race condition by setting timestamp of user\u0027s crontab file, when editing the file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client:vixie-cron-4:4.1-81.el5.i386",
          "5Client:vixie-cron-4:4.1-81.el5.ia64",
          "5Client:vixie-cron-4:4.1-81.el5.ppc",
          "5Client:vixie-cron-4:4.1-81.el5.s390x",
          "5Client:vixie-cron-4:4.1-81.el5.src",
          "5Client:vixie-cron-4:4.1-81.el5.x86_64",
          "5Client:vixie-cron-debuginfo-4:4.1-81.el5.i386",
          "5Client:vixie-cron-debuginfo-4:4.1-81.el5.ia64",
          "5Client:vixie-cron-debuginfo-4:4.1-81.el5.ppc",
          "5Client:vixie-cron-debuginfo-4:4.1-81.el5.s390x",
          "5Client:vixie-cron-debuginfo-4:4.1-81.el5.x86_64",
          "5Server:vixie-cron-4:4.1-81.el5.i386",
          "5Server:vixie-cron-4:4.1-81.el5.ia64",
          "5Server:vixie-cron-4:4.1-81.el5.ppc",
          "5Server:vixie-cron-4:4.1-81.el5.s390x",
          "5Server:vixie-cron-4:4.1-81.el5.src",
          "5Server:vixie-cron-4:4.1-81.el5.x86_64",
          "5Server:vixie-cron-debuginfo-4:4.1-81.el5.i386",
          "5Server:vixie-cron-debuginfo-4:4.1-81.el5.ia64",
          "5Server:vixie-cron-debuginfo-4:4.1-81.el5.ppc",
          "5Server:vixie-cron-debuginfo-4:4.1-81.el5.s390x",
          "5Server:vixie-cron-debuginfo-4:4.1-81.el5.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2010-0424"
        },
        {
          "category": "external",
          "summary": "RHBZ#565809",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=565809"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2010-0424",
          "url": "https://www.cve.org/CVERecord?id=CVE-2010-0424"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-0424",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0424"
        }
      ],
      "release_date": "2010-02-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-02-21T02:21:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/kb/docs/DOC-11259",
          "product_ids": [
            "5Client:vixie-cron-4:4.1-81.el5.i386",
            "5Client:vixie-cron-4:4.1-81.el5.ia64",
            "5Client:vixie-cron-4:4.1-81.el5.ppc",
            "5Client:vixie-cron-4:4.1-81.el5.s390x",
            "5Client:vixie-cron-4:4.1-81.el5.src",
            "5Client:vixie-cron-4:4.1-81.el5.x86_64",
            "5Client:vixie-cron-debuginfo-4:4.1-81.el5.i386",
            "5Client:vixie-cron-debuginfo-4:4.1-81.el5.ia64",
            "5Client:vixie-cron-debuginfo-4:4.1-81.el5.ppc",
            "5Client:vixie-cron-debuginfo-4:4.1-81.el5.s390x",
            "5Client:vixie-cron-debuginfo-4:4.1-81.el5.x86_64",
            "5Server:vixie-cron-4:4.1-81.el5.i386",
            "5Server:vixie-cron-4:4.1-81.el5.ia64",
            "5Server:vixie-cron-4:4.1-81.el5.ppc",
            "5Server:vixie-cron-4:4.1-81.el5.s390x",
            "5Server:vixie-cron-4:4.1-81.el5.src",
            "5Server:vixie-cron-4:4.1-81.el5.x86_64",
            "5Server:vixie-cron-debuginfo-4:4.1-81.el5.i386",
            "5Server:vixie-cron-debuginfo-4:4.1-81.el5.ia64",
            "5Server:vixie-cron-debuginfo-4:4.1-81.el5.ppc",
            "5Server:vixie-cron-debuginfo-4:4.1-81.el5.s390x",
            "5Server:vixie-cron-debuginfo-4:4.1-81.el5.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:0304"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 3.6,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client:vixie-cron-4:4.1-81.el5.i386",
            "5Client:vixie-cron-4:4.1-81.el5.ia64",
            "5Client:vixie-cron-4:4.1-81.el5.ppc",
            "5Client:vixie-cron-4:4.1-81.el5.s390x",
            "5Client:vixie-cron-4:4.1-81.el5.src",
            "5Client:vixie-cron-4:4.1-81.el5.x86_64",
            "5Client:vixie-cron-debuginfo-4:4.1-81.el5.i386",
            "5Client:vixie-cron-debuginfo-4:4.1-81.el5.ia64",
            "5Client:vixie-cron-debuginfo-4:4.1-81.el5.ppc",
            "5Client:vixie-cron-debuginfo-4:4.1-81.el5.s390x",
            "5Client:vixie-cron-debuginfo-4:4.1-81.el5.x86_64",
            "5Server:vixie-cron-4:4.1-81.el5.i386",
            "5Server:vixie-cron-4:4.1-81.el5.ia64",
            "5Server:vixie-cron-4:4.1-81.el5.ppc",
            "5Server:vixie-cron-4:4.1-81.el5.s390x",
            "5Server:vixie-cron-4:4.1-81.el5.src",
            "5Server:vixie-cron-4:4.1-81.el5.x86_64",
            "5Server:vixie-cron-debuginfo-4:4.1-81.el5.i386",
            "5Server:vixie-cron-debuginfo-4:4.1-81.el5.ia64",
            "5Server:vixie-cron-debuginfo-4:4.1-81.el5.ppc",
            "5Server:vixie-cron-debuginfo-4:4.1-81.el5.s390x",
            "5Server:vixie-cron-debuginfo-4:4.1-81.el5.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "cronie: Race condition by setting timestamp of user\u0027s crontab file, when editing the file"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.