CVE-2012-6097: Infoleak
File descriptor leak in cronie 1.4.8, when running in certain environments, might allow local users to read restricted files, as demonstrated by reading /etc/crontab.
Other sources
It was reported [1],[2] that cronie would leak certain fd's. On systems where /etc/crontab is not world-readable this could be an information disclosure concern.
This was introduced upstream in cronie 1.4.8 [3] and fixed in 1.4.9 [4], so the only version of cronie that is affected by this issue is 1.4.8. It was also patched in Fedora via cronie-1.4.8-2.fc15 (see [2] for those details).
[1] https://bugzilla.novell.com/showbug.cgi?id=786096 [2] https://bugzilla.redhat.com/showbug.cgi?id=717505 [3] http://git.fedorahosted.org/cgit/cronie.git/commit/src/cron.c?id=acdf4ae8456888ed78201906ef528f4c28f54582 [4] http://git.fedorahosted.org/cgit/cronie.git/commit/src/cron.c?id=b19007ca9fddd62ecef3af4a7d2d252f1d5e0419
Statement:
Not vulnerable. This issue did not affect the versions of cronie as shipped with Red Hat Enterprise Linux 6.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6097?
CVE-2012-6097 has a moderate severity level, as it can lead to local users gaining unauthorized access to restricted files.
How do I fix CVE-2012-6097?
To fix CVE-2012-6097, upgrade to a version of cronie greater than 1.4.8, specifically version 1.4.9 or later.
What is the impact of CVE-2012-6097 on my system?
The impact of CVE-2012-6097 allows local users to potentially read sensitive files, such as /etc/crontab, if not properly secured.
Which versions of cronie are affected by CVE-2012-6097?
CVE-2012-6097 specifically affects cronie version 1.4.8.
Can CVE-2012-6097 be exploited remotely?
CVE-2012-6097 cannot be exploited remotely; it requires local access to the system to leverage the file descriptor leak.