Bug 5616

Summary:	vixie-cron exploit, revisited
Product:	[Retired] Red Hat Linux	Reporter:	benny
Component:	crontabs	Assignee:	Crutcher Dunnavant <crutcher>
Status:	CLOSED RAWHIDE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	high
Version:	5.2	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2001-04-10 22:01:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description benny 1999-10-06 03:38:41 UTC

I hope this has not already been fixed, because I would
feel like an idiot.

I just upgraded my vixie-cron package from the standard
5.2 install version (I'm sorry, I don't have the version
number handy) to vixie-cron-3.0.1-37.  Supposedly, the
recently-released exploit(s) for this have been fixed.

The "Michal Zalewski" exploit still works, and works
perfectly on this release of vixie-cron.

This was the latest version on updates.redhat.com that I
saw.

It handed me a rootshell within about 20 seconds.  I
thought that this vulnerability was fixed?

Benny

benny

Comment 1 Bill Nottingham 1999-10-06 15:05:59 UTC

Did you restart the cron daemon after upgrading to the errata
package?

Comment 2 Bill Nottingham 1999-10-06 17:00:59 UTC

After further review, the -37 package is OK.