Revision History:
1999-08-27: Updated packages to fix problems on Red Hat Linux 4.2 and 5.2, added credits, remove statement about 'no known exploits'

1. Topic:
A buffer overflow exists in crond, the cron daemon. This could allow local users to gain privilege.

2. Bug IDs fixed:
4706

3. Relevant releases/architectures:
Red Hat Linux 6.0, all architectures

4. Obsoleted by:
None

5. Conflicts with:
None

6. RPMs required:

Intel:

ftp://updates.Red Hat.com/6.0/i386/

vixie- cron-3.0.1-38.i386.rpm

Alpha:

ftp://updates.Red Hat.com/6.0/alpha

vixie-cron-3.0.1-38.alpha.rpm

SPARC:

ftp://updates.Red Hat.com/6.0/sparc

vixie-cron-3.0.1-38.sparc.rpm

Source:

ftp://updates.Red Hat.com/6.0/SRPMS

vixie- cron-3.0.1-38.src.rpm

Architecture neutral:

ftp://updates.Red Hat.com/6.0/noarch/

7. Problem description:
By creating a crontab that runs with a specially formatted 'MAILTO' environment variable, it is possible for local users to overflow a fixed-length buffer in the cron daemon's cron_popen() function. Since the cron daemon runs as root, it would be theoretcially possible for local users to use this buffer overflow to gain root privilege.

Also, it was possible to use specially formatted 'MAILTO' environment variables to send commands to sendmail.

(1999-08-27) The original packages released had the following problems: - Some legitimate e-mail addresses in "MAILTO" could be rejected. - The Red Hat Linux 4.2 and 5.2 packages shipped with logrotate scripts that contained options not present in the logrotate that shipped with those versions. - The Red Hat Linux 4.2 (i386 and SPARC) packages did not correctly reset the SIGCHLD handler, causing zombie processes to be created.

Users who experience these problems should upgrade to the newer packages. There are no known security issues with the previous errata packages.

Thanks go to Tymm Twillman, Martin Schulze, Pawel Veselov and others for noting and providing some fixes for the vulnerabilities.

8. Solution:
For each RPM for your particular architecture, run:

rpm -Uvh filename

where filename is the name of the RPM.

Then restart cron by typing:

/etc/rc.d/init.d/crond restart

9. Verification:

 MD5 sum                           Package Name

 -------------------------------------------------------------------------

804bec06a0f2b25665c9f77b0c03cf4e  i386/vixie-cron-3.0.1-38.i386.rpm

fd3e80ae1c8a2ab84bcbcfe338fe8a92  alpha/vixie-cron-3.0.1-38.alpha.rpm

587e2cee6ab190f6bf9d1727b1bc48bc  sparc/vixie-cron-3.0.1-38.sparc.rpm

1197fe2e1db1591221a27738c2d812d4  SRPMS/vixie-cron-3.0.1-38.src.rpm







 

You can verify each package with the following command:

rpm --checksig filename

If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command:

rpm --checksig --nopgp filename

10. References: