RHSA-2012:0304: Low: vixie-cron security, bug fix, and enhancement update

The vixie-cron package contains the Vixie version of cron. Cron is astandard UNIX daemon that runs specified programs at scheduled times. Thevixie-cron package adds improved security and more powerful configurationoptions to the standard version of cron.A race condition was found in the way the crontab program performed filetime stamp updates on a temporary file created when editing a user crontabfile. A local attacker could use this flaw to change the modification timeof arbitrary system files via a symbolic link attack. (CVE-2010-0424)Red Hat would like to thank Dan Rosenberg for reporting this issue.This update also fixes the following bugs: Cron jobs of users with home directories mounted on a Lightweight Directory Access Protocol (LDAP) server or Network File System (NFS) wereoften refused because jobs were marked as orphaned (typically due to atemporary NSS lookup failure, when NIS and LDAP servers were unreachable).With this update, a database of orphans is created, and cron jobs areperformed as expected. (BZ#455664) Previously, cron did not log any errors if a cron job file located in the /etc/cron.d/ directory contained invalid entries. An upstream patch hasbeen applied to address this problem and invalid entries in the cron jobfiles now produce warning messages. (BZ#460070) Previously, the "@reboot" crontab macro incorrectly ran jobs when the crond daemon was restarted. If the user used the macro on multiplemachines, all entries with the "@reboot" option were executed every timethe crond daemon was restarted. With this update, jobs are executed onlywhen the machine is rebooted. (BZ#476972) The crontab utility is now compiled as a position-independent executable (PIE), which enhances the security of the system. (BZ#480930) When the parent crond daemon was stopped, but a child crond daemon was running (executing a program), the "service crond status" commandincorrectly reported that crond was running. The source code has beenmodified, and the "service crond status" command now correctly reports thatcrond is stopped. (BZ#529632) According to the pam(8) manual page, the cron daemon, crond, supports access control with PAM (Pluggable Authentication Module). However, the PAMconfiguration file for crond did not export environment variables correctlyand, consequently, setting PAM variables via cron did not work. This updateincludes a corrected /etc/pam.d/crond file that exports environmentvariables correctly. Setting pam variables via cron now works as documentedin the pam(8) manual page. (BZ#541189) Previously, the mcstransd daemon modified labels for the crond daemon. When the crond daemon attempted to use the modified label and mcstransd wasnot running, crond used an incorrect label. Consequently, Security-EnhancedLinux (SELinux) denials filled up the cron log, no jobs were executed, andcrond had to be restarted. With this update, both mcstransd and crond useraw SELinux labels, which prevents the problem. (BZ#625016) Previously, the crontab(1) and cron(8) manual pages contained multiple typographical errors. This update fixes those errors. (BZ#699620,BZ#699621)In addition, this update adds the following enhancement: Previously, the crontab utility did not use the Pluggable Authentication Module (PAM) for verification of users. As a consequence, a user couldaccess crontab even if access had been restricted (usually by being deniedin the access.conf file). With this update, crontab returns an errormessage that the user is not allowed to access crontab because of PAMconfiguration. (BZ#249512)All vixie-cron users should upgrade to this updated package, which resolvesthese issues and adds this enhancement.