CVE-2000-1096: Low severity Paul Vixie Vixie Cron vulnerability

Published Jan 9, 2001

Updated

crontab by Paul Vixie uses predictable file names for a temporary file and does not properly ensure that the file is owned by the user executing the crontab -e command, which allows local users with write access to the crontab spool directory to execute arbitrary commands by creating world-writeable temporary files and modifying them while the victim is editing the file.

Affected Software

1 affected component

Paul Vixie Vixie Cron=3.0_pl1

Remediation

Patch Available

http://www.securityfocus.com/bid/1960

Event History

Jan 9, 2001

CVE Published

05:00 AM

Jan 22, 2001

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-1096?

CVE-2000-1096 is considered a high severity vulnerability due to its ability to allow local users to execute arbitrary commands.

How do I fix CVE-2000-1096?

To fix CVE-2000-1096, consider updating Vixie cron to a version that addresses the file ownership issues.

Who is affected by CVE-2000-1096?

Local users with write access to the crontab spool directory on systems running vulnerable versions of Vixie cron are affected by CVE-2000-1096.

What component is vulnerable in CVE-2000-1096?

The vulnerability lies in the crontab command of Vixie cron version 3.0_pl1.

Can CVE-2000-1096 be exploited remotely?

CVE-2000-1096 cannot be exploited remotely, as it requires local access to the system.