CVE-2004-1032: Low severity Thibault Godouet FCron vulnerability

Published Nov 24, 2004

Updated

fcronsighup in Fcron 2.0.1, 2.9.4, and possibly earlier versions allows local users to delete arbitrary files or create arbitrary empty files via a target filename with a large number of leading slash (/) characters such that fcronsighup does not properly append the intended fcrontab.sig to the resulting string.

Affected Software

3 affected components

Thibault Godouet FCron=2.9.4

Thibault Godouet FCron=2.0.1

Gentoo Linux

Remediation

Patch Available

http://security.gentoo.org/glsa/glsa-200411-27.xml

Event History

Nov 24, 2004

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1032?

The severity of CVE-2004-1032 is considered to be medium due to its potential for local users to manipulate file deletion.

How do I fix CVE-2004-1032?

To fix CVE-2004-1032, update Fcron to the latest version that addresses this issue.

What systems are affected by CVE-2004-1032?

CVE-2004-1032 affects Fcron versions 2.0.1, 2.9.4, and potentially earlier versions on systems including Gentoo Linux.

What type of vulnerability is CVE-2004-1032?

CVE-2004-1032 is a local file manipulation vulnerability that allows users to delete or create files using crafted filenames.

Who is the vendor for CVE-2004-1032?

The vendor for CVE-2004-1032 is Thibault Godouet, the maintainer of the Fcron software.