+++ This bug was initially created as a clone of Bug #154920 +++ crontab in Vixie cron 4.1, when running with the -e option, allows local users to read the cron files of other users by changing the file being edited to a symlink. NOTE: there is insufficient information to know whether this is a duplicate of CVE-2001-0235. http://www.securityfocus.com/archive/1/395093
Our current fix for this issue is not complete. A race condition still exists between the time we lstat the file in question, and when we open the file.
This is now fixed with vixie-cron-4.1-8.EL3, available from: http://people.redhat.com/~jvdias/cron/RHEL-3/4.1-8.EL3 The race condition has been circumvented: the fopen() is done as the non-root user, which also fixes the case when the temporary file is made into a hardlink to a root owned file. Please try out the new version and let me know of any issues - thanks.
This bug is fixed with vixie-cron-4.1-8_EL3, available from: http://people.redhat.com/~jvdias/cron/RHEL-3 and should be considered for inclusion in RHEL-3-U7 .
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2006-0117.html