| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <4a6942471003031606u387bfa64hac93bb8edb99e939@mail.gmail.com> Date: Wed, 3 Mar 2010 19:06:22 -0500 From: Dan Rosenberg <dan.j.rosenberg@...il.com> To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com Subject: fcrontab Information Disclosure Vulnerability ============================================ fcrontab Information Disclosure Vulnerability March 3, 2010 CVE-2010-0792 ============================================ ==Description== fcrontab, part of the fcron scheduler, is vulnerable to several race conditions that allow a local attacker to use symbolic links to read unauthorized files. On systems where fcrontab is installed with its own "fcron" group, this allows an attacker to read other non-root users' crontabs and fcron configuration files. On systems where fcrontab is installed suid root, this allows an attacker to read arbitrary files. ==Solution== The developer has released a new version, 3.0.5, to address these vulnerabilities. It is available for download on the developer's website, http://fcron.free.fr. Users are advised to recompile from source or download updated packages from downstream distributors when they become available. ==Credits== This vulnerability was discovered by Dan Rosenberg (dan.j.rosenberg@...il.com). Thanks to Thibault Godouet for his prompt response and new release. ==References== CVE identifier CVE-2010-0792 has been assigned to this issue. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists