Vixie Cron: Denial of service

Background Vixie Cron is a command scheduler with extended syntax over cron. Description During an internal audit, Raphael Marichez of the Gentoo Linux Security Team found that Vixie Cron has weak permissions set on Gentoo, allowing for a local user to create hard links to system and users cron...

Fedora Core 5 : vixie-cron-4.1-55.FC5 (2006-823)

Fri Jul 14 2006 Jason Vas Dias - 4:4.1-55.FC5 - fix bug 198893 - change permissions of cron spool directories to 0700 - fix bug 191823: fix missing BuildRequires: audit-libs-devel Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...

vixie-cron Local Root Exploit

No description provided by source. !/bin/sh echo '.-------------------------------------------------------------------------.' echo '| Marchew Hyperreal Industries ................... [email protected] |' echo "| ...well, it is just me, but it is more elite to speak as a group... |" echo...

RHEL 4 : vixie-cron (RHSA-2006:0539)

Updated vixie-cron packages that fix a privilege escalation issue are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified...

CentOS 4 : vixie-cron (CESA-2006:0539)

Updated vixie-cron packages that fix a privilege escalation issue are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified...

vixie security update

CentOS Errata and Security Advisory CESA-2006:0539 Updated vixie-cron packages that fix a privilege escalation issue are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The vixie-cron package contains the Vixie version of cron...

Jobs start from root when pam_limits enabled

docommand.c in Vixie cron vixie-cron 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in...

Important: Red Hat Security Advisory: vixie-cron security update

Updated vixie-cron packages that fix a privilege escalation issue are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified...

CentOS 3 : vixie-cron (CESA-2006:0117)

An updated vixie-cron package that fixes a bug and security issue is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified program...

GLSA-200606-07 : Vixie Cron: Privilege Escalation

The remote host is affected by the vulnerability described in GLSA-200606-07 Vixie Cron: Privilege Escalation Roman Veretelnikov discovered that Vixie Cron fails to properly check whether it can drop privileges accordingly if setuid in docommand.c fails due to a user exceeding assigned resource...

Vixie Cron: Privilege Escalation

Background Vixie Cron is a command scheduler with extended syntax over cron. Description Roman Veretelnikov discovered that Vixie Cron fails to properly check whether it can drop privileges accordingly if setuid in docommand.c fails due to a user exceeding assigned resource limits. Impact Local...

SUSE-SA:2006:027: cron

The remote host is missing the patch for the advisory SUSE-SA:2006:027 cron. Vixie Cron is the default CRON daemon in all SUSE Linux based distributions. The code in docommand.c in Vixie cron does not check the return code of a setuid call, which might allow local users to gain root privileges if...

rPSA-2006-0082-1 vixie-cron

rPath Security Advisory: 2006-0082-1 Published: 2006-05-25 Products: rPath Linux 1 Rating: Critical Exposure Level Classification: Local Root Deterministic Privilege Escalation Updated Versions: vixie-cron=/conary.rpath.com@rpl:devel//1/4.1-5.2-1 References:...

CVE-2006-2607

docommand.c in Vixie cron vixie-cron 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in...

CVE-2006-2607

docommand.c in Vixie cron vixie-cron 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in...

CVE-2006-2607

docommand.c in Vixie cron vixie-cron 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in...

Deserialization of untrusted data

docommand.c in Vixie cron vixie-cron 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in...

DEBIAN-CVE-2006-2607

docommand.c in Vixie cron vixie-cron 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in...

CVE-2006-2607

CVE-2006-2607 refers to a local privilege escalation in vixie-cron 4.1 where do_command.c does not check the return value of setuid(), potentially allowing a root gain if setuid() fails (e.g., PAM limits or resource limits). Connected advisories confirm this vulnerability and document patches/ups...

CVE-2006-2607

docommand.c in Vixie cron vixie-cron 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in...