Home / mailings

PDF

Gentoo-announce

Posted on 16 April 2007
Gentoo-announce

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)--------------enigAAE4F32C1058957B217646F4Content-Type: text/plain; charset=ISO-8859-15Content-Transfer-Encoding: quoted-printable- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Gentoo Linux Security Advisory GLSA 200704-11- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Vixie Cron: Denial of Service Date: April 16, 2007 Bugs: #164466 ID: 200704-11- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Synopsis========The Gentoo implementation of Vixie Cron is vulnerable to a local Denialof Service.Background==========Vixie Cron is a command scheduler with extended syntax over cron.Affected packages================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-process/vixie-cron < 4.1-r10 >= 4.1-r10Description===========During an internal audit, Raphael Marichez of the Gentoo Linux SecurityTeam found that Vixie Cron has weak permissions set on Gentoo, allowingfor a local user to create hard links to system and users cron files,while a st_nlink check in database.c will generate a superfluous error.Impact======Depending on the partitioning scheme and the "cron" group membership, amalicious local user can create hard links to system or users cronfiles that will trigger the st_link safety check and prevent thetargeted cron file from being run from the next restart or databasereload.Workaround==========There is no known workaround at this time.Resolution==========All Vixie Cron users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-process/vixie-cron-4.1-r1=0"References========== [ 1 ] CVE-2007-1856 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1856Availability============This GLSA and any updates to it are available for viewing atthe Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200704-11.xmlConcerns?=========Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users machines is of utmostimportance to us. Any security concerns should be addressed tosecurity@gentoo.org or alternatively, you may file a bug athttp://bugs.gentoo.org.License=======Copyright 2007 Gentoo Foundation, Inc; referenced textbelongs to its owner(s).The contents of this document are licensed under theCreative Commons - Attribution / Share Alike license.http://creativecommons.org/licenses/by-sa/2.5--------------enigAAE4F32C1058957B217646F4Content-Type: application/pgp-signature; name="signature.asc"Content-Description: OpenPGP digital signatureContent-Disposition: attachment; filename="signature.asc"

 

TOP