Bug 5616 - vixie-cron exploit, revisited
vixie-cron exploit, revisited
Status: CLOSED RAWHIDE
Product: Red Hat Linux
Classification: Retired
Component: crontabs (Show other bugs)
5.2
i386 Linux
high Severity medium
: ---
: ---
Assigned To: Crutcher Dunnavant
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 1999-10-05 23:38 EDT by benny
Modified: 2008-05-01 11:37 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2001-04-10 18:01:17 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description benny 1999-10-05 23:38:41 EDT
I hope this has not already been fixed, because I would
feel like an idiot.

I just upgraded my vixie-cron package from the standard
5.2 install version (I'm sorry, I don't have the version
number handy) to vixie-cron-3.0.1-37.  Supposedly, the
recently-released exploit(s) for this have been fixed.

The "Michal Zalewski" exploit still works, and works
perfectly on this release of vixie-cron.

This was the latest version on updates.redhat.com that I
saw.

It handed me a rootshell within about 20 seconds.  I
thought that this vulnerability was fixed?

Benny

benny@bennyvision.com
Comment 1 Bill Nottingham 1999-10-06 11:05:59 EDT
Did you restart the cron daemon after upgrading to the errata
package?
Comment 2 Bill Nottingham 1999-10-06 13:00:59 EDT
After further review, the -37 package is OK.

Note You need to log in before you can comment on or make changes to this bug.