CVE-2005-1038: Low severity Paul Vixie Vixie Cron vulnerability

Published Apr 10, 2005

Updated

crontab in Vixie cron 4.1, when running with the -e option, allows local users to read the cron files of other users by changing the file being edited to a symlink. NOTE: there is insufficient information to know whether this is a duplicate of CVE-2001-0235.

Affected Software

4 affected components

Paul Vixie Vixie Cron=4.1

redhat Enterprise Linux=4.0

Remediation

Patch Available

http://www.securityfocus.com/bid/13024

Event History

Apr 10, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-1038?

CVE-2005-1038 is considered a moderate severity vulnerability due to its potential to allow unauthorized access to cron files.

How do I fix CVE-2005-1038?

To fix CVE-2005-1038, it is recommended to update Vixie cron to a version that addresses this vulnerability.

Who is affected by CVE-2005-1038?

Users of Vixie cron 4.1, particularly on Red Hat Enterprise Linux versions 4.0, are affected by CVE-2005-1038.

What type of attack does CVE-2005-1038 enable?

CVE-2005-1038 allows local users to perform a symlink attack to read the cron files of other users.

Is CVE-2005-1038 a duplicate of another vulnerability?

There is insufficient information to determine whether CVE-2005-1038 is a duplicate of CVE-2001-0235.