---------------------------------------------------------------------
Red Hat, Inc. Security Advisory
Synopsis: Buffer overflow in cron daemon
Advisory ID: RHSA-1999:030-02
Issue date: 1999-08-25
Updated on: 1999-08-27
Keywords: vixie-cron crond MAILTO
Cross references:
---------------------------------------------------------------------
Revision History:
1999-08-27: Updated packages to fix problems on Red Hat Linux 4.2 and 5.2,
added credits, remove statement about 'no known exploits'
1. Topic:
A buffer overflow exists in crond, the cron daemon. This
could allow local users to gain privilege.
2. Bug IDs fixed (http://developer.redhat.com/bugzilla/):
4706
3. Relevant releases/architectures:
Red Hat Linux 4.2, 5.2, 6.0, all architectures
4. Obsoleted by:
5. Conflicts with:
6. RPMs required:
Red Hat Linux 4.2:
Intel:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/i386/vixie-cron-3.0.1-37.4.2.i386.rpm
Alpha:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/alpha/vixie-cron-3.0.1-37.4.2.alpha.rpm
Sparc:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/sparc/vixie-cron-3.0.1-37.4.2.sparc.rpm
Source packages:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/SRPMS/vixie-cron-3.0.1-37.4.2.src.rpm
Red Hat Linux 5.2:
Intel:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/i386/vixie-cron-3.0.1-37.5.2.i386.rpm
Alpha:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/alpha/vixie-cron-3.0.1-37.5.2.alpha.rpm
Sparc:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/sparc/vixie-cron-3.0.1-37.5.2.sparc.rpm
Source packages:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/SRPMS/vixie-cron-3.0.1-37.5.2.src.rpm
Red Hat Linux 6.0:
Intel:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/i386/vixie-cron-3.0.1-38.i386.rpm
Alpha:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/alpha/vixie-cron-3.0.1-38.alpha.rpm
Sparc:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/sparc/vixie-cron-3.0.1-38.sparc.rpm
Source packages:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/SRPMS/vixie-cron-3.0.1-38.src.rpm
7. Problem description:
By creating a crontab that runs with a specially formatted
'MAILTO' environment variable, it is possible for local users
to overflow a fixed-length buffer in the cron daemon's
cron_popen() function. Since the cron daemon runs as root,
it would be theoretcially possible for local users to use
this buffer overflow to gain root privilege.
Also, it was possible to use specially formatted 'MAILTO'
environment variables to send commands to sendmail.
(1999-08-25)
The original pacakges released had the following problems:
- Some legitimate e-mail addresses in "MAILTO" could be
rejected.
- The Red Hat Linux 4.2 and 5.2 packages shipped with logrotate
scripts that contained options not present in the logrotate
that shipped with those versions.
- The Red Hat Linux 4.2 (i386 and SPARC) packages did not correctly
reset the SIGCHLD handler, causing zombie processes to be created.
Users who experience these problems should upgrade to the newer
pacakges. There are no known security issues with the previous
errata packages.
Thanks go to Tymm Twillman, Martin Schulze, Pawel Veselov and others
for noting and providing some fixes for the vulnerabilities.
8. Solution:
For each RPM for your particular architecture, run:
rpm -Uvh <filename>
where filename is the name of the RPM.
9. Verification:
MD5 sum Package Name
--------------------------------------------------------------------------
e84b81e4c950add3b8565c91a9565807 i386/vixie-cron-3.0.1-37.4.2.i386.rpm
ecbc5c1b1c8bf72dd15319de5bf64292 alpha/vixie-cron-3.0.1-37.4.2.alpha.rpm
6825a04bf5dbf5dfbddad5221bd14489 sparc/vixie-cron-3.0.1-37.4.2.sparc.rpm
6365d813ef298479e35450c74862fab8 SRPMS/vixie-cron-3.0.1-37.4.2.src.rpm
88e5b200468c66c264283be01f674d4d i386/vixie-cron-3.0.1-37.5.2.i386.rpm
b014e9335c7644484462fb0d2f86afa8 alpha/vixie-cron-3.0.1-37.5.2.alpha.rpm
850c86e7972e54b3d025e3fe3e7d8464 sparc/vixie-cron-3.0.1-37.5.2.sparc.rpm
64fa16237dc7aea30c58e9a6d1774d9e SRPMS/vixie-cron-3.0.1-37.5.2.src.rpm
804bec06a0f2b25665c9f77b0c03cf4e i386/vixie-cron-3.0.1-38.i386.rpm
fd3e80ae1c8a2ab84bcbcfe338fe8a92 alpha/vixie-cron-3.0.1-38.alpha.rpm
587e2cee6ab190f6bf9d1727b1bc48bc sparc/vixie-cron-3.0.1-38.sparc.rpm
1197fe2e1db1591221a27738c2d812d4 SRPMS/vixie-cron-3.0.1-38.src.rpm
These packages are PGP signed by Red Hat Inc. for security. Our key
is available at:
http://www.redhat.com/corp/contact.html
You can verify each package with the following command:
rpm --checksig <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nopgp <filename>
10. References:
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:59:21 PDT