Bug 5616 - vixie-cron exploit, revisited
Summary: vixie-cron exploit, revisited
Status: CLOSED RAWHIDE
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: crontabs   
(Show other bugs)
Version: 5.2
Hardware: i386
OS: Linux
high
medium
Target Milestone: ---
Assignee: Crutcher Dunnavant
QA Contact:
URL:
Whiteboard:
Keywords: Security
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 1999-10-06 03:38 UTC by benny
Modified: 2008-05-01 15:37 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2001-04-10 22:01:17 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description benny 1999-10-06 03:38:41 UTC
I hope this has not already been fixed, because I would
feel like an idiot.

I just upgraded my vixie-cron package from the standard
5.2 install version (I'm sorry, I don't have the version
number handy) to vixie-cron-3.0.1-37.  Supposedly, the
recently-released exploit(s) for this have been fixed.

The "Michal Zalewski" exploit still works, and works
perfectly on this release of vixie-cron.

This was the latest version on updates.redhat.com that I
saw.

It handed me a rootshell within about 20 seconds.  I
thought that this vulnerability was fixed?

Benny

benny@bennyvision.com

Comment 1 Bill Nottingham 1999-10-06 15:05:59 UTC
Did you restart the cron daemon after upgrading to the errata
package?

Comment 2 Bill Nottingham 1999-10-06 17:00:59 UTC
After further review, the -37 package is OK.


Note You need to log in before you can comment on or make changes to this bug.