Linux.com Article DB: RHSA-1999:030-02 - RedHat Further Cron Update

--------------------------------------------------------------------- Red Hat, Inc. Security AdvisorySynopsis: Buffer overflow in cron daemon Advisory ID: RHSA-1999:030-02Issue date: 1999-08-25Updated on: 1999-08-27 Keywords: vixie-cron crond MAILTOCross references: --------------------------------------------------------------------- Revision History: 1999-08-27: Updated packages to fix problems on Red Hat Linux 4.2 and 5.2, added credits, remove statement about 'no known exploits'1. Topic: A buffer overflow exists in crond, the cron daemon. This could allow local users to gain privilege. 2. Bug IDs fixed (http://developer.redhat.com/bugzilla/):4706 3. Relevant releases/architectures: Red Hat Linux 4.2, 5.2, 6.0, all architectures4. Obsoleted by:5. Conflicts with: 6. RPMs required:Red Hat Linux 4.2:Intel: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/i386/vixie-cron-3.0.1-37.4.2.i386.rpm Alpha: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/alpha/vixie-cron-3.0.1-37.4.2.alpha.rpm Sparc: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/sparc/vixie-cron-3.0.1-37.4.2.sparc.rpm Source packages: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/SRPMS/vixie-cron-3.0.1-37.4.2.src.rpm Red Hat Linux 5.2:Intel: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/i386/vixie-cron-3.0.1-37.5.2.i386.rpm Alpha: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/alpha/vixie-cron-3.0.1-37.5.2.alpha.rpm Sparc: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/sparc/vixie-cron-3.0.1-37.5.2.sparc.rpm Source packages: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/SRPMS/vixie-cron-3.0.1-37.5.2.src.rpm Red Hat Linux 6.0:Intel: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/i386/vixie-cron-3.0.1-38.i386.rpm Alpha: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/alpha/vixie-cron-3.0.1-38.alpha.rpm Sparc: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/sparc/vixie-cron-3.0.1-38.sparc.rpm Source packages: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/SRPMS/vixie-cron-3.0.1-38.src.rpm 7. Problem description: By creating a crontab that runs with a specially formatted 'MAILTO' environment variable, it is possible for local users to overflow a fixed-length buffer in the cron daemon's cron_popen() function. Since the cron daemon runs as root, it would be theoretcially possible for local users to use this buffer overflow to gain root privilege. Also, it was possible to use specially formatted 'MAILTO' environment variables to send commands to sendmail.(1999-08-25) The original pacakges released had the following problems: - Some legitimate e-mail addresses in "MAILTO" could be rejected. - The Red Hat Linux 4.2 and 5.2 packages shipped with logrotate scripts that contained options not present in the logrotate that shipped with those versions. - The Red Hat Linux 4.2 (i386 and SPARC) packages did not correctly reset the SIGCHLD handler, causing zombie processes to be created. Users who experience these problems should upgrade to the newer pacakges. There are no known security issues with the previouserrata packages. Thanks go to Tymm Twillman, Martin Schulze, Pawel Veselov and others for noting and providing some fixes for the vulnerabilities.8. Solution: For each RPM for your particular architecture, run:rpm -Uvh where filename is the name of the RPM.9. Verification: MD5 sum Package Name -------------------------------------------------------------------------- e84b81e4c950add3b8565c91a9565807 i386/vixie-cron-3.0.1-37.4.2.i386.rpm ecbc5c1b1c8bf72dd15319de5bf64292 alpha/vixie-cron-3.0.1-37.4.2.alpha.rpm 6825a04bf5dbf5dfbddad5221bd14489 sparc/vixie-cron-3.0.1-37.4.2.sparc.rpm 6365d813ef298479e35450c74862fab8 SRPMS/vixie-cron-3.0.1-37.4.2.src.rpm 88e5b200468c66c264283be01f674d4d i386/vixie-cron-3.0.1-37.5.2.i386.rpm b014e9335c7644484462fb0d2f86afa8 alpha/vixie-cron-3.0.1-37.5.2.alpha.rpm 850c86e7972e54b3d025e3fe3e7d8464 sparc/vixie-cron-3.0.1-37.5.2.sparc.rpm 64fa16237dc7aea30c58e9a6d1774d9e SRPMS/vixie-cron-3.0.1-37.5.2.src.rpm 804bec06a0f2b25665c9f77b0c03cf4e i386/vixie-cron-3.0.1-38.i386.rpm fd3e80ae1c8a2ab84bcbcfe338fe8a92 alpha/vixie-cron-3.0.1-38.alpha.rpm 587e2cee6ab190f6bf9d1727b1bc48bc sparc/vixie-cron-3.0.1-38.sparc.rpm 1197fe2e1db1591221a27738c2d812d4 SRPMS/vixie-cron-3.0.1-38.src.rpm These packages are PGP signed by Red Hat Inc. for security. Our key is available at:http://www.redhat.com/corp/contact.html You can verify each package with the following command: rpm --checksig If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nopgp 10. References:

Originally Published: Saturday, 28 August 1999	Author: Quentin Cregan
Published to: news_enhance_security/Security News	Page: 1/1 - [Printable]
RHSA-1999:030-02 - RedHat Further Cron Update Another problem has been located in Crontab. RedHat has released an update, which follows a week which included finding faults in other major applications, such as wu-ftpd.

	Page 1 of 1
--------------------------------------------------------------------- Red Hat, Inc. Security AdvisorySynopsis: Buffer overflow in cron daemon Advisory ID: RHSA-1999:030-02Issue date: 1999-08-25Updated on: 1999-08-27 Keywords: vixie-cron crond MAILTOCross references: --------------------------------------------------------------------- Revision History: 1999-08-27: Updated packages to fix problems on Red Hat Linux 4.2 and 5.2, added credits, remove statement about 'no known exploits'1. Topic: A buffer overflow exists in crond, the cron daemon. This could allow local users to gain privilege. 2. Bug IDs fixed (http://developer.redhat.com/bugzilla/):4706 3. Relevant releases/architectures: Red Hat Linux 4.2, 5.2, 6.0, all architectures4. Obsoleted by:5. Conflicts with: 6. RPMs required:Red Hat Linux 4.2:Intel: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/i386/vixie-cron-3.0.1-37.4.2.i386.rpm Alpha: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/alpha/vixie-cron-3.0.1-37.4.2.alpha.rpm Sparc: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/sparc/vixie-cron-3.0.1-37.4.2.sparc.rpm Source packages: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/SRPMS/vixie-cron-3.0.1-37.4.2.src.rpm Red Hat Linux 5.2:Intel: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/i386/vixie-cron-3.0.1-37.5.2.i386.rpm Alpha: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/alpha/vixie-cron-3.0.1-37.5.2.alpha.rpm Sparc: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/sparc/vixie-cron-3.0.1-37.5.2.sparc.rpm Source packages: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/SRPMS/vixie-cron-3.0.1-37.5.2.src.rpm Red Hat Linux 6.0:Intel: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/i386/vixie-cron-3.0.1-38.i386.rpm Alpha: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/alpha/vixie-cron-3.0.1-38.alpha.rpm Sparc: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/sparc/vixie-cron-3.0.1-38.sparc.rpm Source packages: rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/SRPMS/vixie-cron-3.0.1-38.src.rpm 7. Problem description: By creating a crontab that runs with a specially formatted 'MAILTO' environment variable, it is possible for local users to overflow a fixed-length buffer in the cron daemon's cron_popen() function. Since the cron daemon runs as root, it would be theoretcially possible for local users to use this buffer overflow to gain root privilege. Also, it was possible to use specially formatted 'MAILTO' environment variables to send commands to sendmail.(1999-08-25) The original pacakges released had the following problems: - Some legitimate e-mail addresses in "MAILTO" could be rejected. - The Red Hat Linux 4.2 and 5.2 packages shipped with logrotate scripts that contained options not present in the logrotate that shipped with those versions. - The Red Hat Linux 4.2 (i386 and SPARC) packages did not correctly reset the SIGCHLD handler, causing zombie processes to be created. Users who experience these problems should upgrade to the newer pacakges. There are no known security issues with the previouserrata packages. Thanks go to Tymm Twillman, Martin Schulze, Pawel Veselov and others for noting and providing some fixes for the vulnerabilities.8. Solution: For each RPM for your particular architecture, run:rpm -Uvh where filename is the name of the RPM.9. Verification: MD5 sum Package Name -------------------------------------------------------------------------- e84b81e4c950add3b8565c91a9565807 i386/vixie-cron-3.0.1-37.4.2.i386.rpm ecbc5c1b1c8bf72dd15319de5bf64292 alpha/vixie-cron-3.0.1-37.4.2.alpha.rpm 6825a04bf5dbf5dfbddad5221bd14489 sparc/vixie-cron-3.0.1-37.4.2.sparc.rpm 6365d813ef298479e35450c74862fab8 SRPMS/vixie-cron-3.0.1-37.4.2.src.rpm 88e5b200468c66c264283be01f674d4d i386/vixie-cron-3.0.1-37.5.2.i386.rpm b014e9335c7644484462fb0d2f86afa8 alpha/vixie-cron-3.0.1-37.5.2.alpha.rpm 850c86e7972e54b3d025e3fe3e7d8464 sparc/vixie-cron-3.0.1-37.5.2.sparc.rpm 64fa16237dc7aea30c58e9a6d1774d9e SRPMS/vixie-cron-3.0.1-37.5.2.src.rpm 804bec06a0f2b25665c9f77b0c03cf4e i386/vixie-cron-3.0.1-38.i386.rpm fd3e80ae1c8a2ab84bcbcfe338fe8a92 alpha/vixie-cron-3.0.1-38.alpha.rpm 587e2cee6ab190f6bf9d1727b1bc48bc sparc/vixie-cron-3.0.1-38.sparc.rpm 1197fe2e1db1591221a27738c2d812d4 SRPMS/vixie-cron-3.0.1-38.src.rpm These packages are PGP signed by Red Hat Inc. for security. Our key is available at:http://www.redhat.com/corp/contact.html You can verify each package with the following command: rpm --checksig If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nopgp 10. References:
	Page 1 of 1