CVE-2010-0424: Race Condition
Race condition was found in the way vixie-cron and cronie used to set up timestamp (modification time) for crontab file of the individual user by editing the file. A local attacker could use this flaw to conduct unintended changes of timestamp (modification time) value against various system files, potentially leading to denial of their service.
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Other sources
The editcmd function in crontab.c in (1) cronie before 1.4.4 and (2) Vixie cron (vixie-cron) allows local users to change the modification times of arbitrary files, and consequently cause a denial of service, via a symlink attack on a temporary file in the /tmp directory.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0424?
CVE-2010-0424 is classified as a medium severity vulnerability due to its potential to allow local users to alter files and cause denial of service.
How do I fix CVE-2010-0424?
To fix CVE-2010-0424, upgrade to cronie version 1.4.4 or later, or vixie-cron version 4:4.1-81.el5 or later.
Who is affected by CVE-2010-0424?
CVE-2010-0424 affects users of cronie versions prior to 1.4.4 and vixie-cron versions before 4:4.1-81.el5.
What type of attack is associated with CVE-2010-0424?
CVE-2010-0424 is associated with a symlink attack that can manipulate temporary files in the /tmp directory.
What are the implications of exploiting CVE-2010-0424?
Exploiting CVE-2010-0424 can lead to denial of service by allowing local users to change the modification times of arbitrary files.