Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2012.0209 Low: vixie-cron security, bug fix, and enhancement update 22 February 2012 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: vixie-cron Publisher: Red Hat Operating System: Red Hat Enterprise Linux Server 5 Red Hat Enterprise Linux WS/Desktop 5 Impact/Access: Modify Arbitrary Files -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2010-0424 Reference: ESB-2012.0202 ESB-2010.0199 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2012-0304.html - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Low: vixie-cron security, bug fix, and enhancement update Advisory ID: RHSA-2012:0304-03 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0304.html Issue date: 2012-02-21 Keywords: orphan, pam, pie CVE Names: CVE-2010-0424 ===================================================================== 1. Summary: An updated vixie-cron package that fixes one security issue, several bugs, and adds one enhancement is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times. The vixie-cron package adds improved security and more powerful configuration options to the standard version of cron. A race condition was found in the way the crontab program performed file time stamp updates on a temporary file created when editing a user crontab file. A local attacker could use this flaw to change the modification time of arbitrary system files via a symbolic link attack. (CVE-2010-0424) Red Hat would like to thank Dan Rosenberg for reporting this issue. This update also fixes the following bugs: * Cron jobs of users with home directories mounted on a Lightweight Directory Access Protocol (LDAP) server or Network File System (NFS) were often refused because jobs were marked as orphaned (typically due to a temporary NSS lookup failure, when NIS and LDAP servers were unreachable). With this update, a database of orphans is created, and cron jobs are performed as expected. (BZ#455664) * Previously, cron did not log any errors if a cron job file located in the /etc/cron.d/ directory contained invalid entries. An upstream patch has been applied to address this problem and invalid entries in the cron job files now produce warning messages. (BZ#460070) * Previously, the "@reboot" crontab macro incorrectly ran jobs when the crond daemon was restarted. If the user used the macro on multiple machines, all entries with the "@reboot" option were executed every time the crond daemon was restarted. With this update, jobs are executed only when the machine is rebooted. (BZ#476972) * The crontab utility is now compiled as a position-independent executable (PIE), which enhances the security of the system. (BZ#480930) * When the parent crond daemon was stopped, but a child crond daemon was running (executing a program), the "service crond status" command incorrectly reported that crond was running. The source code has been modified, and the "service crond status" command now correctly reports that crond is stopped. (BZ#529632) * According to the pam(8) manual page, the cron daemon, crond, supports access control with PAM (Pluggable Authentication Module). However, the PAM configuration file for crond did not export environment variables correctly and, consequently, setting PAM variables via cron did not work. This update includes a corrected /etc/pam.d/crond file that exports environment variables correctly. Setting pam variables via cron now works as documented in the pam(8) manual page. (BZ#541189) * Previously, the mcstransd daemon modified labels for the crond daemon. When the crond daemon attempted to use the modified label and mcstransd was not running, crond used an incorrect label. Consequently, Security-Enhanced Linux (SELinux) denials filled up the cron log, no jobs were executed, and crond had to be restarted. With this update, both mcstransd and crond use raw SELinux labels, which prevents the problem. (BZ#625016) * Previously, the crontab(1) and cron(8) manual pages contained multiple typographical errors. This update fixes those errors. (BZ#699620, BZ#699621) In addition, this update adds the following enhancement: * Previously, the crontab utility did not use the Pluggable Authentication Module (PAM) for verification of users. As a consequence, a user could access crontab even if access had been restricted (usually by being denied in the access.conf file). With this update, crontab returns an error message that the user is not allowed to access crontab because of PAM configuration. (BZ#249512) All vixie-cron users should upgrade to this updated package, which resolves these issues and adds this enhancement. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 455664 - Adoptions at the crontab orphanage needed 460070 - cronjobs in /etc/cron.d entries with an invalid username produce no error in the logs 476972 - crontab error with @reboot entry 480930 - Make crontab a PIE 529632 - [PATCH] "service crond status" return invalid status 541189 - cron and /etc/security/pam_env.conf problem 565809 - CVE-2010-0424 vixie-cron, cronie: Race condition by setting timestamp of user's crontab file, when editing the file 625016 - crond requires a restart if mcstransd is stopped 699620 - Typo in patch for crond manpage removes mention of cron.d 699621 - man page typo -- two be -- should be not two be's ;) 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/vixie-cron-4.1-81.el5.src.rpm i386: vixie-cron-4.1-81.el5.i386.rpm vixie-cron-debuginfo-4.1-81.el5.i386.rpm x86_64: vixie-cron-4.1-81.el5.x86_64.rpm vixie-cron-debuginfo-4.1-81.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/vixie-cron-4.1-81.el5.src.rpm i386: vixie-cron-4.1-81.el5.i386.rpm vixie-cron-debuginfo-4.1-81.el5.i386.rpm ia64: vixie-cron-4.1-81.el5.ia64.rpm vixie-cron-debuginfo-4.1-81.el5.ia64.rpm ppc: vixie-cron-4.1-81.el5.ppc.rpm vixie-cron-debuginfo-4.1-81.el5.ppc.rpm s390x: vixie-cron-4.1-81.el5.s390x.rpm vixie-cron-debuginfo-4.1-81.el5.s390x.rpm x86_64: vixie-cron-4.1-81.el5.x86_64.rpm vixie-cron-debuginfo-4.1-81.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2010-0424.html https://access.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFPQyTdXlSAg2UNWIIRAsf/AJ0Rnii8h7UKh/bB9cHIRiKzVWQQ9QCfY/YT EAoMEyKMLLcrhkaqoQEkMW0= =LyP3 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBT0R6j+4yVqjM2NGpAQJecQ/9EA66f3xDLFhtCMv42lh0+oudKreAHWGG 5iXr6q2f2MshioGOqkiYr87m8PDQ407oCYcV5HBMQN10lk7fW0vGjNL2rirU1wAn YkGTo6QDXTAV/689R/r90Zv9ZVpTdXaJNTnyAmjLjcfwN8NZG+1alfp+yLCt9LPD /0PZf5zGQLwyJQ7Nb618euk/zuuS47908C0PTosyz1C2QUjqkJ1gMLOAc/kg1jmC WnjRcarz0NSAk5YpEMIx4yjgpT2F0UOKTCIL9/ZqzG49cGfaw3JfxQxjlP1p7Uxu oK7Lo9bbuRQrrM8mSVJs6psHQvDPksGee2KQYkeRFMV8CUwoQMCpCtBXHAmIn9lK wzj32NLF838NNYchRK7j87ksG4s8EuUeaAX7xXFYCDJhH8/wnBiW2eDHMzRB9XFK vu85gRi1mG6C/x+WZRYJL9r3+hTUvhmhZspDdewMcWl/nCbnXAlyHlF6fiJZ7TC5 14/1O/eqm4kuWtLui7rPuvA0qpljTvDpbwgsK7zerplWBFLqwiM0UPHX7qJ7eoeZ nDP1MuRs/iKbQhbGCp2YKh7TgT2bEQN77RnHHeDxnkRySFD3ZshYt89HZl+wbxco kAn5pINl8xtlW2orerAKHSarPlwWIq3AaL63/ZdYcG83StsBjdIkrgNVZrEJFlKG tGRAX+7dwbE= =kOHM -----END PGP SIGNATURE-----