[security-alerts] FW: [SA20380] Vixie Cron "do_command.c" setuid Security Issue

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> Vixie Cron "do_command.c" setuid Security Issue
> 
> SECUNIA ADVISORY ID:
> SA20380
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/20380/
> 
> CRITICAL:
> Less critical
> 
> IMPACT:
> Privilege escalation
> 
> WHERE:
> Local system
> 
> SOFTWARE:
> Vixie Cron 4.x
> http://secunia.com/product/10269/
> 
> DESCRIPTION:
> Roman Veretelnikov has reported a security issue in Vixie Cron, which
> potentially can be exploited by malicious, local users to perform
> certain actions with escalated privileges.
> 
> The security issue is caused due to missing checks for whether the
> "setuid()" call has succeeded before running a job submitted by a
> user. This may cause the user's job to run with root privileges if
> the "setuid()" fails due to e.g. PAM failures or resource limits.
> 
> The security issue has been reported in version 4.1. Other versions
> may also be affected.
> 
> SOLUTION:
> Restrict the use of cron to trusted users only.
> 
> Some Linux vendors have issued fixed packages.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Roman Veretelnikov
> 
> ORIGINAL ADVISORY:
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178431
> http://bugs.gentoo.org/show_bug.cgi?id=134194
>