[SECURITY] New Debian cron packages released

---------------------------------------------------------------------------- Debian Security Advisory [email protected] http://www.debian.org/security/ Daniel Jacobowitz November 17, 2000 - ---------------------------------------------------------------------------- Package: cron Vulnerability:...

Дырка в vixie cron

При созданиие задания задание помещается во временный файл со случайным именем задаваемым достаточно коротким числом. При этом не проверяется существование файла и разрешения на файл. Что позволяет "подменить" чужое задание, создав большое число временных файлов...

vixie cron...

Attached shell-script exploits fopen + preserved umask vulnerability in Paul Vixie's cron code. It will work on systems where /var/spool/cron is user-readable eg. 0755 - AFAIR Debian does so. RedHat at least 6.1 and previous have mode 0700 on /var/spool/cron, and thus it isn't exploitable in its...

CVE-1999-0872

Buffer overflow in Vixie cron allows local users to gain root access via a long MAILTO environment variable in a crontab file...

CVE-1999-0872

CVE-1999-0872 is a vulnerability in Vixie cron where a buffer overflow can be triggered by a long MAILTO value in a crontab, enabling local users to gain root access. The Red Hat CVE entry and related records confirm the issue but do not provide remediation steps or patched versions in the connec...

CVE-1999-0768

Buffer overflow in Vixie Cron on Red Hat systems via the MAILTO environmental variable...

CVE-1999-0768

CVE-1999-0768 is a confirmed issue affecting Red Hat systems using Vixie Cron, where a buffer overflow can be triggered via the MAILTO environment variable. The connected Red Hat advisory reiterates the same description and confirms the vulnerability exists in Vixie Cron on Red Hat platforms. The...

CVE-1999-0297

The CVE-1999-0297 issue is a buffer overflow in the Vixie Cron library up to version 3.0, enabling local users to obtain root access via a long environmental variable. The vulnerability is caused by a buffer overflow in the library's handling of environment data. Impact is local privilege escalat...

CVE-1999-0769

Vixie Cron on Linux systems allows local users to set parameters of sendmail commands via the MAILTO environmental variable...

CVE-1999-0297

Buffer overflow in Vixie Cron library up to version 3.0 allows local users to obtain root access via a long environmental variable...

CVE-1999-0769

CVE-1999-0769 affects Vixie Cron on Linux systems. The vulnerability allows local users to modify parameters of sendmail commands by manipulating the MAILTO environment variable, as described in multiple sources. Root cause is misuse of MAILTO by cron the environment passed to mail-related comman...

cron_root_patch.txt

Subject: Vixie Cron version 3.0pl1 vulnerable to root exploit To: [email protected] Vixie Cron version 3.0pl1 vulne.ems Content-Type: text/plain; charset=us-ascii PGP Signature Status: unknown Signer: Unknown, Key ID xAE8F7CF5 Signed: 8/28/99 11:42:41 PM Verified: 9/22/99 1:44:11 AM BEGIN...

rootcron.txt

!/bin/sh clear echo '------------------------------------------------------------------' echo 'Marchew Hyperreal Industries ' echo 'Stumilowy Las Team ' echo '---------------------------- presents ----------------------------' echo echo ' -= vixie-cron root sploit by Michal Zalewski =-' echo echo...

RedHat Linux 4.25.26.0 S.u.S.E Linux 6.06.1 - Cron Buffer Overflow (1)

RedHat Linux 4.25.26.0 S.u.S.E Linux 6.06.1 - Cron Buffer Overflow 1 // source: https://www.securityfocus.com/bid/602/info The version of Vixie cron that ships with RedHat versions 4.2, 5.2 and 6.0 is vulnerable to a local buffer overflow attack. By utilizing the MAILTO environment variable, a...

RedHat Linux 4.2/5.2/6.0 / S.u.S.E Linux 6.0/6.1 - Cron Buffer Overflow (1)

// source: https://www.securityfocus.com/bid/602/info The version of Vixie cron that ships with RedHat versions 4.2, 5.2 and 6.0 is vulnerable to a local buffer overflow attack. By utilizing the MAILTO environment variable, a buffer can be overflown in the cronpopen function, allowing an attacker...

CVE-1999-0769

Vixie Cron on Linux systems allows local users to set parameters of sendmail commands via the MAILTO environmental variable...

CVE-1999-0872

Buffer overflow in Vixie cron allows local users to gain root access via a long MAILTO environment variable in a crontab file...

CVE-1999-0768

Buffer overflow in Vixie Cron on Red Hat systems via the MAILTO environmental variable...

RedHat Linux 4.25.26.0 S.u.S.E Linux 6.06.1 - Cron Buffer Overflow (2)

RedHat Linux 4.25.26.0 S.u.S.E Linux 6.06.1 - Cron Buffer Overflow 2 // source: https://www.securityfocus.com/bid/602/info The version of Vixie cron that ships with RedHat versions 4.2, 5.2 and 6.0 is vulnerable to a local buffer overflow attack. By utilizing the MAILTO environment variable, a...

Caldera OpenLinux 2.2 Debian 2.12.2 RedHat 6.0 - Vixie Cron MAILTO Sendmail

Caldera OpenLinux 2.2 Debian 2.12.2 RedHat 6.0 - Vixie Cron MAILTO Sendmail Caldera OpenLinux 2.2 ,Debian Linux 2.1/2.2,RedHat Linux = 6.0 Vixie Cron MAILTO Sendmail Vulnerability source: https://www.securityfocus.com/bid/611/info Failure by the vixie cron daemon from validating the contents of a...