+++ This bug was initially created as a clone of Bug #154920 +++
crontab in Vixie cron 4.1, when running with the -e option, allows local users
to read the cron files of other users by changing the file being edited to a
symlink. NOTE: there is insufficient information to know whether this is a
duplicate of CVE-2001-0235.
Our current fix for this issue is not complete. A race condition still exists
between the time we lstat the file in question, and when we open the file.
This is now fixed with vixie-cron-4.1-8.EL3, available from:
The race condition has been circumvented: the fopen() is done as
the non-root user, which also fixes the case when the temporary
file is made into a hardlink to a root owned file.
Please try out the new version and let me know of any issues - thanks.
This bug is fixed with vixie-cron-4.1-8_EL3, available from:
and should be considered for inclusion in RHEL-3-U7 .
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.