Lucene search
Ubuntu.comUB:CVE-2006-2607HistoryMay 25, 2006 - 12:00 a.m.
CVE-2006-2607
2006-05-2500:00:00
ubuntu.com
ubuntu.com
9
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.001 Low
EPSS
Percentile
47.9%
do_command.c in Vixie cron (vixie-cron) 4.1 does not check the return code
of a setuid call, which might allow local users to gain root privileges if
setuid fails in cases such as PAM failures or resource limits, as
originally demonstrated by a program that exceeds the process limits as
defined in /etc/security/limits.conf.
Bugs
- <https://bugs.launchpad.net/ubuntu/+source/cron/+bug/46649>
- <http://bugs.gentoo.org/show_bug.cgi?id=134194>
- <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=528434>
Notes
| Author | Note |
|---|---|
| jdstrand | was mistakenly marked not-affected. 3.0pl1-64 added checks for setuid() failing, but did not add the checks for setgid() or initgroups() |
Related
nessus
nessus
GLSA-200606-07 : Vixie Cron: Privilege Escalation
2006-06-11 00:00:00
Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : cron vulnerability (USN-778-1)
2009-06-02 00:00:00
openSUSE 10 Security Update : cron (cron-1440)
2007-10-17 00:00:00
gentoo
gentoo
Vixie Cron: Privilege Escalation
2006-06-09 00:00:00
centos
centos
vixie security update
2006-07-12 18:56:16
suse
suse
local privilege escalation in cron
2006-05-31 13:32:34
cve
cve
CVE-2006-2607
2006-05-25 20:02:00
debiancve
debiancve
CVE-2006-2607
2006-05-25 20:02:00
prion
prion
Deserialization of untrusted data
2006-05-25 20:02:00
openvas
openvas
Ubuntu: Security Advisory (USN-778-1)
2009-06-05 00:00:00
Gentoo Security Advisory GLSA 200606-07 (vixie-cron)
2008-09-24 00:00:00
Ubuntu USN-778-1 (cron)
2009-06-05 00:00:00
ubuntu
ubuntu
cron vulnerability
2009-06-01 00:00:00
myhack58
myhack58
redhat
redhat
(RHSA-2006:0539) vixie-cron security update
2006-07-12 00:00:00
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.001 Low
EPSS
Percentile
47.9%
Related for UB:CVE-2006-2607