vixie-cron.sh

Attached shell-script exploits fopen + preserved umask vulnerability in Paul Vixie's cron code. It will work on systems where /var/spool/cron is user-readable eg. 0755 - AFAIR Debian does so. RedHat at least 6.1 and previous have mode 0700 on /var/spool/cron, and thus it isn't exploitable in its...

HP-UX 10.2011.0 - crontab tmp File

HP-UX 10.2011.0 - crontab tmp File source: https://www.securityfocus.com/bid/1845/info crontab is a binary in the cron package of the HP-UX cron implementation which allows a user to create a file of scheduled commands. A vulnerabiltiy in crontab exists that allows a user to read any file on an...

Diskcheck 3.1.1 Symlink Vulnerability

Diskcheck 3.1.1 Symlink Vulnerability 1 Introduction DiskCheck is a Perl script that monitors how much space is available on your hard drive. Basically, it checks your drive space every hour and takes action based on the specifications in the config file /etc/diskcheck.conf. DiskCheck 3.1.1 is...

Predictability Problems in IRIX Cron and Compilers

Crimelabs, Inc. www.crimelabs.com Security Note Crimelabs Security Note CLABS200004 Title: Poor Tempfile Use in IRIX: Compilers and Cron Date: 21 June, 2000 Application: MIPSPro Compilers 7.1, 7.2.1 tested, cron Platforms: IRIX 6.3, 6.5 Severity: Moderate, higher in some instances Author: Jose...

Проблемы временных файлов в IRIX

компиляторы MIPSPro, cron создают временные файлы с предсказуемыми именами, что позволяет пользователю подменить или получить доступ к содержимому этих файлов...

CVE-2000-0293

aaabase in SuSE Linux 6.3, and cron.daily in earlier versions, allow local users to delete arbitrary files by creating files whose names include spaces, which are then incorrectly interpreted by aaabase when it deletes expired files from the /tmp directory...

local user can delete arbitrary files on SuSE-Linux

Hello, If MAXDAYSINTMP 0 in /etc/rc.config on a SuSE-Linux system, a local user can delete arbitrary files by doing some commands like these: mkdir -p "/tmp/hhh /somedirectory" touch -t some-early-date "/tmp/hhh /somedirectory/somefile" sleep 1d The bug is in /etc/cron.daily/aaabase for SuSE...

SuSE Linux 6.x - Arbitrary File Deletion

source: https://www.securityfocus.com/bid/1130/info A vulnerability exists in SuSE Linux, version 6.3 and prior, that can allow arbitrary users to delete any file on the system. If the MAXDAYSINTMP variable is set in /etc/rc.config to be larger than 0, any local user can remove any file on the...

CVE-1999-0872

CVE-1999-0872 is a vulnerability in Vixie cron where a buffer overflow can be triggered by a long MAILTO value in a crontab, enabling local users to gain root access. The Red Hat CVE entry and related records confirm the issue but do not provide remediation steps or patched versions in the connec...

CVE-1999-0872

Buffer overflow in Vixie cron allows local users to gain root access via a long MAILTO environment variable in a crontab file...

CVE-1999-0768

Buffer overflow in Vixie Cron on Red Hat systems via the MAILTO environmental variable...

CVE-1999-0768

CVE-1999-0768 is a confirmed issue affecting Red Hat systems using Vixie Cron, where a buffer overflow can be triggered via the MAILTO environment variable. The connected Red Hat advisory reiterates the same description and confirms the vulnerability exists in Vixie Cron on Red Hat platforms. The...

CVE-1999-0297

The CVE-1999-0297 issue is a buffer overflow in the Vixie Cron library up to version 3.0, enabling local users to obtain root access via a long environmental variable. The vulnerability is caused by a buffer overflow in the library's handling of environment data. Impact is local privilege escalat...

CVE-1999-0297

Buffer overflow in Vixie Cron library up to version 3.0 allows local users to obtain root access via a long environmental variable...

CVE-1999-0769

CVE-1999-0769 affects Vixie Cron on Linux systems. The vulnerability allows local users to modify parameters of sendmail commands by manipulating the MAILTO environment variable, as described in multiple sources. Root cause is misuse of MAILTO by cron the environment passed to mail-related comman...

CVE-1999-0769

Vixie Cron on Linux systems allows local users to set parameters of sendmail commands via the MAILTO environmental variable...

cron_root_patch.txt

Subject: Vixie Cron version 3.0pl1 vulnerable to root exploit To: [email protected] Vixie Cron version 3.0pl1 vulne.ems Content-Type: text/plain; charset=us-ascii PGP Signature Status: unknown Signer: Unknown, Key ID xAE8F7CF5 Signed: 8/28/99 11:42:41 PM Verified: 9/22/99 1:44:11 AM BEGIN...

rootcron.txt

!/bin/sh clear echo '------------------------------------------------------------------' echo 'Marchew Hyperreal Industries ' echo 'Stumilowy Las Team ' echo '---------------------------- presents ----------------------------' echo echo ' -= vixie-cron root sploit by Michal Zalewski =-' echo echo...

cron_bof.txt

Subject: Re: RHSA-1999:030-01 Buffer overflow in cron daemon To: [email protected] On Wed, 25 Aug 1999, Bill Nottingham wrote: To the best of our knowledge, no known exploits exist at this time. Also, it was possible to use specially formatted 'MAILTO' environment variables to send comman...

[SECURITY] New versions of cron fixes possible root exploit

Debian Security Advisory [email protected] http://www.debian.org/security/ Martin Schulze August 30, 1999 Red Hat has recently released a Security Advisory RHSA-1999:030-01 covering a reverse denial of service bug in the vixie cron package. As user you could restart sendmail even if the host...