CVE-2010-0424: Race Condition
First published: Tue Feb 16 2010(Updated: )
The edit_cmd function in crontab.c in (1) cronie before 1.4.4 and (2) Vixie cron (vixie-cron) allows local users to change the modification times of arbitrary files, and consequently cause a denial of service, via a symlink attack on a temporary file in the /tmp directory.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/vixie-cron | <4:4.1-81.el5 | 4:4.1-81.el5 |
| Fedorahosted Cronie | <=1.4.3 | |
| paul Vixie Vixie cron |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/38741
- http://secunia.com/advisories/38700
- http://www.securityfocus.com/bid/38391
- http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035762.html
- https://bugzilla.redhat.com/show_bug.cgi?id=565809
- http://secunia.com/advisories/48104
- http://git.fedorahosted.org/git/cronie.git?p=cronie.git%3Ba=commit%3Bh=9e4a8fa5f9171fb724981f53879c9b20264aeb61
- https://access.redhat.com/security/cve/CVE-2010-0424
- http://admin.fedoraproject.org/updates/cronie-1.4.3-4.fc12
- http://admin.fedoraproject.org/updates/cronie-1.4.4-1.fc13
- http://www.redhat.com/security/updates/classification/
- http://admin.fedoraproject.org/updates/cronie-1.3-4.fc11
- https://rhn.redhat.com/errata/RHSA-2012-0304.html
- https://www.cve.org/CVERecord?id=CVE-2010-0424 https://nvd.nist.gov/vuln/detail/CVE-2010-0424
- https://access.redhat.com/errata/RHSA-2012:0304
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2010-0424.json
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-0424
- collector/redhat-cve
- agent/software-canonical-lookup
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- package-manager/redhat
- vendor/fedorahosted
- canonical/fedorahosted cronie
- version/fedorahosted cronie/1.4.3
- vendor/paul vixie
- canonical/paul vixie vixie cron