vixie cron...

Attached shell-script exploits fopen + preserved umask vulnerability in Paul Vixie's cron code. It will work on systems where /var/spool/cron is user-readable eg. 0755 - AFAIR Debian does so. RedHat at least 6.1 and previous have mode 0700 on /var/spool/cron, and thus it isn't exploitable in its...

Re: [ Hackerslab bug_paper ] HP-UX crontab temporary file symboliclink vulnerability

Hi, Tested on 4.0-RELEASE FreeBSD 4.0-RELEASE 9 4.1-RELEASE FreeBSD 4.1-RELEASE 1: Can read any file wich start with comment simbol $ ls -l /etc/sudoers -r-------- 1 root wheel 313 24 oct 20:20 /etc/sudoers $ id uid=1002alf gid=1002alf groups=1002alf $ crontab -e /tmp/crontab.hLmjTbK417 :!sh Make...

[ Hackerslab bug_paper ] HP-UX crontab temporary file symbolic link vulnerability

============================================================================ ==== Hackerslab bugpaper HP-UX crontab temporary file symbolic link vulnerability ============================================================================ ==== File : /usr/bin/crontab SYSTEM : HP-UX Tested in HP-UX...

hp-ux.crontab.sh

Hackerslab bugpaper HP-UX crontab temporary file symbolic link vulnerability Attach ====================== crontab.sh ================================ !/bin/sh HP-UX 11.00 crontab Kyong-won,Cho [email protected] Usage : ./crontab.sh if -z "$1" then echo "Usage : $0 " exit fi cat /tmp/crontabex...

HP-UX 10.20/11.0 - crontab '/tmp' File

source: https://www.securityfocus.com/bid/1845/info crontab is a binary in the cron package of the HP-UX cron implementation which allows a user to create a file of scheduled commands. A vulnerabiltiy in crontab exists that allows a user to read any file on an HP-UX system. crontab as implemented...

HP-UX 10.2011.0 - crontab tmp File

HP-UX 10.2011.0 - crontab tmp File source: https://www.securityfocus.com/bid/1845/info crontab is a binary in the cron package of the HP-UX cron implementation which allows a user to create a file of scheduled commands. A vulnerabiltiy in crontab exists that allows a user to read any file on an...

CVE-2000-0579

IRIX crontab is affected: it creates temporary files with predictable names and the user’s umask, enabling local users to modify another user’s crontab while it is being edited. The CVSS data indicates local access with partial confidentiality/integrity/availability impact. No remediation details...

CVE-2000-0579

IRIX crontab creates temporary files with predictable file names and with the umask of the user, which could allow local users to modify another user's crontab file as it is being edited...

CVE-2000-0579

IRIX crontab creates temporary files with predictable file names and with the umask of the user, which could allow local users to modify another user's crontab file as it is being edited...

CVE-1999-0872

Buffer overflow in Vixie cron allows local users to gain root access via a long MAILTO environment variable in a crontab file...

CVE-1999-0872

CVE-1999-0872 is a vulnerability in Vixie cron where a buffer overflow can be triggered by a long MAILTO value in a crontab, enabling local users to gain root access. The Red Hat CVE entry and related records confirm the issue but do not provide remediation steps or patched versions in the connec...

CVE-1999-1589

Unspecified vulnerability in crontab in IBM AIX 3.2 allows local users to gain root privileges via unknown attack vectors...

crontab_exploit.txt

Subject: Vixie Crontab exploit code To: [email protected] Vixie Crontab exploit code begin vixie-ex ---------------------------------------------------------------------- !/bin/sh Vixie crontab exploit Local user can gain root access. Tested redhat linux : 4.2, 5.0, 5.1, 6.0 Tested vixie...

CVE-1999-0872

Buffer overflow in Vixie cron allows local users to gain root access via a long MAILTO environment variable in a crontab file...

FreeBSD-SA-96:20.stack-overflow

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-96:20 Security Advisory FreeBSD, Inc. Topic: unauthorized access via buffer overruns cron, crontab, ppp Category: core Module: cron, crontab, ppp Announced: 1996-12-16...