Fcron 'fcrontab' Symbolic Link Arbitrary File Access Vulnerabilities

Bugtraq ID:	38531
Class:	Design Error
CVE:	CVE-2010-0792
Remote:	No
Local:	Yes
Published:	Mar 04 2010 12:00AM
Updated:	Apr 13 2015 09:49PM
Credit:	Dan Rosenberg
Vulnerable:	Gentoo Linux Fcron Fcron 3.0.4 Fcron Fcron 3.0 Fcron Fcron 2.9.5 .1 Fcron Fcron 2.9.5 Fcron Fcron 2.9.4
Not Vulnerable:	Fcron Fcron 3.0.5

Fcron 'fcrontab' Symbolic Link Arbitrary File Access Vulnerabilities

Fcron is prone to multiple arbitrary-file-access vulnerabilities.

Local attackers can exploit these issues to obtain sensitive information that may lead to other attacks.

Fcron versions prior to 3.0.5 are vulnerable.

Fcron 'fcrontab' Symbolic Link Arbitrary File Access Vulnerabilities

An attacker uses readily available commands to exploit the issues.

Fcron 'fcrontab' Symbolic Link Arbitrary File Access Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Fcron Fcron 2.9.4

• Fcron fcron-3.0.5.src.tar.gz
  http://fcron.free.fr/archives/fcron-3.0.5.src.tar.gz

Fcron Fcron 2.9.5 .1

• Fcron fcron-3.0.5.src.tar.gz
  http://fcron.free.fr/archives/fcron-3.0.5.src.tar.gz

Fcron Fcron 2.9.5

• Fcron fcron-3.0.5.src.tar.gz
  http://fcron.free.fr/archives/fcron-3.0.5.src.tar.gz

Fcron Fcron 3.0

• Fcron fcron-3.0.5.src.tar.gz
  http://fcron.free.fr/archives/fcron-3.0.5.src.tar.gz

Fcron Fcron 3.0.4

• Fcron fcron-3.0.5.src.tar.gz
  http://fcron.free.fr/archives/fcron-3.0.5.src.tar.gz

Fcron 'fcrontab' Symbolic Link Arbitrary File Access Vulnerabilities

References:

• Changes From version 3.0.4 to 3.0.5 (Fcron)
  
• Fcron Homepage (Fcron)
  
• fcrontab Information Disclosure Vulnerability (Dan Rosenberg)