CVE-2010-0424: Race Condition

Reference Links

• http://secunia.com/advisories/38741
• http://secunia.com/advisories/38700
• http://www.securityfocus.com/bid/38391
• http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035762.html
• https://bugzilla.redhat.com/show_bug.cgi?id=565809
• http://secunia.com/advisories/48104
• http://git.fedorahosted.org/git/cronie.git?p=cronie.git%3Ba=commit%3Bh=9e4a8fa5f9171fb724981f53879c9b20264aeb61
• https://access.redhat.com/security/cve/CVE-2010-0424
• http://admin.fedoraproject.org/updates/cronie-1.4.3-4.fc12
• http://admin.fedoraproject.org/updates/cronie-1.4.4-1.fc13
• http://www.redhat.com/security/updates/classification/
• http://admin.fedoraproject.org/updates/cronie-1.3-4.fc11
• https://rhn.redhat.com/errata/RHSA-2012-0304.html
• https://www.cve.org/CVERecord?id=CVE-2010-0424 https://nvd.nist.gov/vuln/detail/CVE-2010-0424
• https://access.redhat.com/errata/RHSA-2012:0304
• https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2010-0424.json

Parent vulnerabilities

(Appears in the following advisories)

• RHSA-2012:0304

Frequently Asked Questions

• What is the severity of CVE-2010-0424?

  CVE-2010-0424 is classified as a medium severity vulnerability due to its potential to allow local users to alter files and cause denial of service.

• How do I fix CVE-2010-0424?

  To fix CVE-2010-0424, upgrade to cronie version 1.4.4 or later, or vixie-cron version 4:4.1-81.el5 or later.

• Who is affected by CVE-2010-0424?

  CVE-2010-0424 affects users of cronie versions prior to 1.4.4 and vixie-cron versions before 4:4.1-81.el5.

• What type of attack is associated with CVE-2010-0424?

  CVE-2010-0424 is associated with a symlink attack that can manipulate temporary files in the /tmp directory.

• What are the implications of exploiting CVE-2010-0424?

  Exploiting CVE-2010-0424 can lead to denial of service by allowing local users to change the modification times of arbitrary files.