Vixie Cron /var/spool/cron Temporary Crontab File Vulnerability

BID:1960

Info

Vixie Cron /var/spool/cron Temporary Crontab File Vulnerability

Bugtraq ID: 1960
Class: Race Condition Error
CVE:
Remote: No
Local: Yes
Published: Nov 17 2000 12:00AM
Updated: Nov 17 2000 12:00AM
Credit: This vulnerability was first announced on the BugTraq mailing list by Michal Zalewski <[email protected]> on November 17, 2000.
Vulnerable: Paul Vixie Vixie Cron 3.0 pl1
+ Debian Linux 2.2 sparc
 + Debian Linux 2.2 powerpc
 + Debian Linux 2.2 arm
 + Debian Linux 2.2 alpha
 + Debian Linux 2.2 68k
 + Debian Linux 2.2
+ Progeny Debian 1.0
Not Vulnerable:

Discussion

Vixie Cron /var/spool/cron Temporary Crontab File Vulnerability

Vixie cron is a scheduling daemon written by Paul Vixie, and distributed with many free UNIX Operating Systems. A problem exists that could allow a user to execute commands with priviledge of another user.

The problem occurs in the /var/spool/cron directory and the handling of the temporary files created when one edits crontab. This vulnerability affects systems with permission of 0755 set on the /var/spool/cron directory. Files created in the /var/spool/cron directory by crontab inherit root ownership and group, and UMASK of the user executing crontab. The files created are uniform in name, with the file extension ending in the PID of the crontab process being executed. Crontab also does not check for the existance of a file before it opens a session and begins. It is possible for a malicious user to generate multiple temporary files in /var/spool/cron with world write permission. A user executing crontab -e would have their state stored in a file that could be written to by the malicious user. The attacker could then write a malicious cron entry into the temporary file, which would be saved. This would result arbitrary commands in the malicious crontab being executed with the priviledges of the target user.

Exploit / POC

Vixie Cron /var/spool/cron Temporary Crontab File Vulnerability

This exploit was written by Michal Zalewski <[email protected]> and posted to Bugtraq on November 17, 2000:

Solution / Fix

References

Vixie Cron /var/spool/cron Temporary Crontab File Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report