Full Disclosure mailing list archives
[ GLSA 200411-27 ] Fcron: Multiple vulnerabilities
From: lewk () gentoo org
Date: Fri, 19 Nov 2004 15:21:37 -0500
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200411-27 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Fcron: Multiple vulnerabilities Date: November 18, 2004 Bugs: #71311 ID: 200411-27 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities in Fcron can allow a local user to potentially cause a Denial of Service. Background ========== Fcron is a command scheduler with extended capabilities over cron and anacron. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/fcron <= 2.9.5 *>= 2.0.2 >= 2.9.5.1 Description =========== Due to design errors in the fcronsighup program, Fcron may allow a local user to bypass access restrictions (CAN-2004-1031), view the contents of root owned files (CAN-2004-1030), remove arbitrary files or create empty files (CAN-2004-1032), and send a SIGHUP to any process. A vulnerability also exists in fcrontab which may allow local users to view the contents of fcron.allow and fcron.deny (CAN-2004-1033). Impact ====== A local attacker could exploit these vulnerabilities to perform a Denial of Service on the system running Fcron. Workaround ========== Make sure the fcronsighup and fcrontab binaries are only executable by trusted users. Resolution ========== All Fcron users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/fcron-2.0.2" References ========== [ 1 ] CAN-2004-1030 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1030 [ 2 ] CAN-2004-1031 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1031 [ 3 ] CAN-2004-1032 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1032 [ 4 ] CAN-2004-1033 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1033 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200411-27.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security () gentoo org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2004 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.0
Attachment:
2#signature.asc
Description:
Attachment:
3#Mime.822
Description:
Attachment:
GWAVADAT.TXT
Description:
Current thread:
- [ GLSA 200411-27 ] Fcron: Multiple vulnerabilities Luke Macken (Nov 18)
- <Possible follow-ups>
- [ GLSA 200411-27 ] Fcron: Multiple vulnerabilities lewk (Nov 19)