CVE-1999-0769: High severity Paul Vixie Vixie Cron vulnerability
Vixie Cron on Linux systems allows local users to set parameters of sendmail commands via the MAILTO environmental variable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure MAILTO variables in system and user crontabs do not include sendmail command-line options. Set MAILTO to a valid email address or leave it empty to disable mail delivery; disallow embedding sendmail parameters in MAILTO.
Vixie Cron MAILTO = empty or a plain email address (no sendmail command-line parameters) - Operational
Audit all system and user crontab files for MAILTO entries and remove or sanitize any that include sendmail parameters. Update affected crontabs to use only plain email addresses or an empty MAILTO.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0769?
CVE-1999-0769 is considered a local privilege escalation vulnerability.
How do I fix CVE-1999-0769?
To fix CVE-1999-0769, update Vixie Cron to a version that does not allow local users to manipulate the MAILTO variable.
Who is affected by CVE-1999-0769?
CVE-1999-0769 affects users on Linux systems running certain versions of Vixie Cron.
What versions of Vixie Cron are impacted by CVE-1999-0769?
CVE-1999-0769 specifically impacts Vixie Cron version 3.0_pl1 and earlier.
Can CVE-1999-0769 be exploited remotely?
CVE-1999-0769 cannot be exploited remotely as it requires local user access.