CVE-2017-9525
Summary
| CVE | CVE-2017-9525 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2017-06-09 16:29:00 UTC |
|---|
| Updated | 2021-12-16 18:44:00 UTC |
|---|
| Description | In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| oss-security - Vixie/ISC Cron group crontab to root escalation |
MISC |
www.openwall.com |
Mailing List, Third Party Advisory |
| #864466 - cron: CVE-2017-9525: group crontab to root escalation via postinst - Debian Bug report logs |
MISC |
bugs.debian.org |
Issue Tracking, Third Party Advisory, Vendor Advisory |
| [SECURITY] [DLA 2801-1] cron security update |
MLIST |
lists.debian.org |
|
| Debian/Ubuntu Cron Symlink Validation Flaw Lets Local Users Bypass Security Restrictions - SecurityTracker |
SECTRACK |
www.securitytracker.com |
Third Party Advisory, VDB Entry |
| [SECURITY] [DLA 1723-1] cron security update |
MLIST |
lists.debian.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 178874 Debian Security Update for cron (DLA 2801-1)
- 198775 Ubuntu Security Notification for Cron Vulnerabilities (USN-5259-2)
