Bugzilla – Bug 178863
VUL-0: CVE-2006-2607: privilege escalation in vixie-cron
Last modified: 2018-12-06 12:59:09 UTC
To: coley@mitre.org Cc: vendor-sec@lst.de From: Josh Bressers <bressers@redhat.com> Subject: [vendor-sec] CVE Request (vixie-cron) Errors-To: vendor-sec-admin@lst.de Date: Thu, 25 May 2006 13:27:22 -0400 Steve, There is a public issue in vixie cron which can lead to a privilege escalation. A Gentoo bug was filed yesterday, which then after some investigation I found it was reported to our BTS (but missed) earlier this year: http://bugs.gentoo.org/show_bug.cgi?id=134194 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178431 Thanks. -- JB
====================================================== Name: CVE-2006-2607 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2607 Reference: CONFIRM:http://bugs.gentoo.org/show_bug.cgi?id=134194 Reference: CONFIRM:https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178431 do_command.c in Vixie cron (vixie-cron) 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits.
Are there any official patches from author?
http://bugs.gentoo.org/attachment.cgi?id=87472
packages, that also contain setuid calls without checking return value: openswan NX X ppp xinetd arts kdebase3 kdelibs3 kdemultimedia3 kdenetwork3 kdeedu3 icecream valknut emacs openmotif bitchx tvtime arpwatch ZynAddSubFX zsh xterm xemacs openssh dvgt rarpd libsmbclient3
taper argus avifile ipgrab
this is not going to be a good week. I succeeded in trivially exploiting this problem with CRON at least.
dump openib gridengine pdsh xglx vocalbin fte falconseye epic amanda
ganglia-monitor-core wterm cvs spamassassin hanterm-xf
fixed cron packages submitted for: UL1/SLES8, SLEC8, SLES9, SLES10, 9.1, 9.2, 9.3, 10.0, 10.1 security-team please handle rest of process, e.g. patchinfo
Created attachment 86044 [details] xx.c
updates released. thanks!