--nextPart1214539.90OzCZfaPs

Content-Type: text/plain;

  charset="us-ascii"

Content-Transfer-Encoding: 7bit

Content-Disposition: inline



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory                           GLSA 200606-07

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                                            http://security.gentoo.org/

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



  Severity: High

     Title: Vixie Cron: Privilege Escalation

      Date: June 09, 2006

      Bugs: #134194

        ID: 200606-07



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Synopsis

========



Vixie Cron allows local users to execute programs as root.



Background

==========



Vixie Cron is a command scheduler with extended syntax over cron.



Affected packages

=================



    -------------------------------------------------------------------

     Package                 /  Vulnerable  /               Unaffected

    -------------------------------------------------------------------

  1  sys-process/vixie-cron      < 4.1-r9                    >= 4.1-r9



Description

===========



Roman Veretelnikov discovered that Vixie Cron fails to properly check

whether it can drop privileges accordingly if setuid() in do_command.c

fails due to a user exceeding assigned resource limits.



Impact

======



Local users can execute code with root privileges by deliberately

exceeding their assigned resource limits and then starting a command

through Vixie Cron. This requires resource limits to be in place on the

machine.



Workaround

==========



There is no known workaround at this time.



Resolution

==========



All Vixie Cron users should upgrade to the latest version:



    # emerge --sync

    # emerge --ask --oneshot --verbose
 ">=sys-process/vixie-cron-4.1-r9"



References

==========



  [ 1 ] CVE-2006-2607

        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2607



Availability

============



This GLSA and any updates to it are available for viewing at

the Gentoo Security Website:



  http://security.gentoo.org/glsa/glsa-200606-07.xml



Concerns?

=========



Security is a primary focus of Gentoo Linux and ensuring the

confidentiality and security of our users machines is of utmost

importance to us. Any security concerns should be addressed to

security@gentoo.org or alternatively, you may file a bug at

http://bugs.gentoo.org.



License

=======



Copyright 2006 Gentoo Foundation, Inc; referenced text

belongs to its owner(s).



The contents of this document are licensed under the

Creative Commons - Attribution / Share Alike license.



http://creativecommons.org/licenses/by-sa/2.5



--nextPart1214539.90OzCZfaPs

Content-Type: application/pgp-signature



-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.2.2 (GNU/Linux)



iD8DBQBEiZRdzKC5hMHO6rkRAuTFAKCRGdHhVWFA3ryhkxrM6niUoCVsegCffBTg

m5GaIQMqzsCLaGj41Tlbhcg=

=zH8X

-----END PGP SIGNATURE-----



--nextPart1214539.90OzCZfaPs--

-- 

gentoo-announce@gentoo.org mailing list