The edit_cmd function in crontab.c in (1) cronie before 1.4.4 and (2) Vixie cron (vixie-cron) allows local users to change the modification times of arbitrary files, and consequently cause a denial of service, via a symlink attack on a temporary file in the /tmp directory.

The remote host is affected by the vulnerability described in GLSA-201311-04 (Vixie cron: Denial of Service)

    Vixie cron contains a race condition relating to atime and mtime values       of temporary files.
  Impact :

    A local attacker could change the modification time of files, possibly       resulting in a Denial of Service condition via a symlink attack.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2012:0304 :

An updated vixie-cron package that fixes one security issue, several bugs, and adds one enhancement is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times.
The vixie-cron package adds improved security and more powerful configuration options to the standard version of cron.

A race condition was found in the way the crontab program performed file time stamp updates on a temporary file created when editing a user crontab file. A local attacker could use this flaw to change the modification time of arbitrary system files via a symbolic link attack. (CVE-2010-0424)

Red Hat would like to thank Dan Rosenberg for reporting this issue.

This update also fixes the following bugs :

* Cron jobs of users with home directories mounted on a Lightweight Directory Access Protocol (LDAP) server or Network File System (NFS) were often refused because jobs were marked as orphaned (typically due to a temporary NSS lookup failure, when NIS and LDAP servers were unreachable). With this update, a database of orphans is created, and cron jobs are performed as expected. (BZ#455664)

* Previously, cron did not log any errors if a cron job file located in the /etc/cron.d/ directory contained invalid entries. An upstream patch has been applied to address this problem and invalid entries in the cron job files now produce warning messages. (BZ#460070)

* Previously, the '@reboot' crontab macro incorrectly ran jobs when the crond daemon was restarted. If the user used the macro on multiple machines, all entries with the '@reboot' option were executed every time the crond daemon was restarted. With this update, jobs are executed only when the machine is rebooted. (BZ#476972)

* The crontab utility is now compiled as a position-independent executable (PIE), which enhances the security of the system.
(BZ#480930)

* When the parent crond daemon was stopped, but a child crond daemon was running (executing a program), the 'service crond status' command incorrectly reported that crond was running. The source code has been modified, and the 'service crond status' command now correctly reports that crond is stopped. (BZ#529632)

* According to the pam(8) manual page, the cron daemon, crond, supports access control with PAM (Pluggable Authentication Module).
However, the PAM configuration file for crond did not export environment variables correctly and, consequently, setting PAM variables via cron did not work. This update includes a corrected /etc/pam.d/crond file that exports environment variables correctly.
Setting pam variables via cron now works as documented in the pam(8) manual page. (BZ#541189)

* Previously, the mcstransd daemon modified labels for the crond daemon. When the crond daemon attempted to use the modified label and mcstransd was not running, crond used an incorrect label.
Consequently, Security-Enhanced Linux (SELinux) denials filled up the cron log, no jobs were executed, and crond had to be restarted. With this update, both mcstransd and crond use raw SELinux labels, which prevents the problem. (BZ#625016)

* Previously, the crontab(1) and cron(8) manual pages contained multiple typographical errors. This update fixes those errors.
(BZ#699620, BZ#699621)

In addition, this update adds the following enhancement :

* Previously, the crontab utility did not use the Pluggable Authentication Module (PAM) for verification of users. As a consequence, a user could access crontab even if access had been restricted (usually by being denied in the access.conf file). With this update, crontab returns an error message that the user is not allowed to access crontab because of PAM configuration. (BZ#249512)

All vixie-cron users should upgrade to this updated package, which resolves these issues and adds this enhancement.

The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times.
The vixie-cron package adds improved security and more powerful configuration options to the standard version of cron.

A race condition was found in the way the crontab program performed file time stamp updates on a temporary file created when editing a user crontab file. A local attacker could use this flaw to change the modification time of arbitrary system files via a symbolic link attack. (CVE-2010-0424)

This update also fixes the following bugs :

  - Cron jobs of users with home directories mounted on a     Lightweight Directory Access Protocol (LDAP) server or     Network File System (NFS) were often refused because     jobs were marked as orphaned (typically due to a     temporary NSS lookup failure, when NIS and LDAP servers     were unreachable). With this update, a database of     orphans is created, and cron jobs are performed as     expected.

  - Previously, cron did not log any errors if a cron job     file located in the /etc/cron.d/ directory contained     invalid entries. An upstream patch has been applied to     address this problem and invalid entries in the cron job     files now produce warning messages.

  - Previously, the '@reboot' crontab macro incorrectly ran     jobs when the crond daemon was restarted. If the user     used the macro on multiple machines, all entries with     the '@reboot' option were executed every time the crond     daemon was restarted. With this update, jobs are     executed only when the machine is rebooted.

  - The crontab utility is now compiled as a     position-independent executable (PIE), which enhances     the security of the system.

  - When the parent crond daemon was stopped, but a child     crond daemon was running (executing a program), the     'service crond status' command incorrectly reported that     crond was running. The source code has been modified,     and the 'service crond status' command now correctly     reports that crond is stopped.

  - According to the pam(8) manual page, the cron daemon,     crond, supports access control with PAM (Pluggable     Authentication Module). However, the PAM configuration     file for crond did not export environment variables     correctly and, consequently, setting PAM variables via     cron did not work. This update includes a corrected     /etc/pam.d/crond file that exports environment variables     correctly. Setting pam variables via cron now works as     documented in the pam(8) manual page.

  - Previously, the mcstransd daemon modified labels for the     crond daemon. When the crond daemon attempted to use the     modified label and mcstransd was not running, crond used     an incorrect label. Consequently, Security-Enhanced     Linux (SELinux) denials filled up the cron log, no jobs     were executed, and crond had to be restarted. With this     update, both mcstransd and crond use raw SELinux labels,     which prevents the problem.

  - Previously, the crontab(1) and cron(8) manual pages     contained multiple typographical errors. This update     fixes those errors.

In addition, this update adds the following enhancement :

  - Previously, the crontab utility did not use the     Pluggable Authentication Module (PAM) for verification     of users. As a consequence, a user could access crontab     even if access had been restricted (usually by being     denied in the access.conf file). With this update,     crontab returns an error message that the user is not     allowed to access crontab because of PAM configuration.

All vixie-cron users should upgrade to this updated package, which resolves these issues and adds this enhancement.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2012:0304 advisory.

  - vixie-cron, cronie: Race condition by setting timestamp of user's crontab file, when editing the file     (CVE-2010-0424)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update of cron fixes a race condition in crontab that can be used to change the time-stamp of arbitrary files while editing the crontab entry.

  - CVSS v2 Base Score: 3.6 Additionally the return value of     initgroups() is verified now. (CVE-2010-0424)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0424

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Bug #565809 - CVE-2010-0424 vixie-cron, cronie: Race     condition by setting timestamp of user's crontab file,     when editing the file

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2010-0424 vixie-cron, cronie: Race condition by setting timestamp of user's crontab file, when editing the file .

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of cron fixes a race condition in crontab that can be used to change the time-stamp of arbitrary files while editing the crontab entry.

Additionally the return value of initgroups() is verified now.
(CVE-2010-0424: CVSS v2 Base Score: 3.6)

This update of cron fixes a race condition in crontab that can be used to change the time-stamp of arbitrary files while editing the crontab entry. CVE-2010-0424: CVSS v2 Base Score: 3.6 Additionally the return value of initgroups() is verified now.

ID	Name	Product	Family	Severity
70779	GLSA-201311-04 : Vixie cron: Denial of Service	Nessus	Gentoo Local Security Checks	low
68475	Oracle Linux 5 : vixie-cron (ELSA-2012-0304)	Nessus	Oracle Linux Local Security Checks	low
61273	Scientific Linux Security Update : vixie-cron on SL5.x i386/x86_64 (20120221)	Nessus	Scientific Linux Local Security Checks	low
58058	RHEL 5 : vixie-cron (RHSA-2012:0304)	Nessus	Red Hat Local Security Checks	high
49841	SuSE 10 Security Update : cron (ZYPP Patch Number 6865)	Nessus	SuSE Local Security Checks	low
47348	Fedora 11 : cronie-1.3-4.fc11 (2010-4300)	Nessus	Fedora Local Security Checks	low
47323	Fedora 13 : cronie-1.4.4-1.fc13 (2010-3642)	Nessus	Fedora Local Security Checks	low
47294	Fedora 12 : cronie-1.4.3-4.fc12 (2010-2751)	Nessus	Fedora Local Security Checks	low
45106	SuSE 10 Security Update : cron (ZYPP Patch Number 6864)	Nessus	SuSE Local Security Checks	low
45104	SuSE 11 Security Update : cron (SAT Patch Number 2027)	Nessus	SuSE Local Security Checks	low
45101	openSUSE Security Update : cron (cron-2026)	Nessus	SuSE Local Security Checks	low
45098	openSUSE Security Update : cron (cron-2026)	Nessus	SuSE Local Security Checks	low
45095	openSUSE Security Update : cron (cron-2026)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2010-0424

high

Tenable Plugins

low

low

low

high

low

low

low

low

low

low

low

low

low