Date: Fri, 27 Aug 1999 14:46:53 -0400
From: Bill Nottingham <notting@redhat.com>
To: redhat-watch-list@redhat.com
Subject: [RHSA-1999:030-02] Buffer overflow in cron daemon

---------------------------------------------------------------------
		   Red Hat, Inc. Security Advisory

Synopsis:		Buffer overflow in cron daemon
Advisory ID:		RHSA-1999:030-02
Issue date:		1999-08-25
Updated on:		1999-08-27
Keywords:		vixie-cron crond MAILTO
Cross references:
---------------------------------------------------------------------

Revision History:
 1999-08-27: Updated packages to fix problems on Red Hat Linux 4.2 and 5.2,
             added credits, remove statement about 'no known exploits'

1. Topic:

A buffer overflow exists in crond, the cron daemon. This
could allow local users to gain privilege.

2. Bug IDs fixed (http://developer.redhat.com/bugzilla/):

4706

3. Relevant releases/architectures:

Red Hat Linux 4.2, 5.2, 6.0, all architectures

4. Obsoleted by:

5. Conflicts with:

6. RPMs required:

Red Hat Linux 4.2:

Intel:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/i386/vixie-cron-3.0.1-37.4.2.i386.rpm

Alpha:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/alpha/vixie-cron-3.0.1-37.4.2.alpha.rpm

Sparc:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/sparc/vixie-cron-3.0.1-37.4.2.sparc.rpm

Source packages:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/4.2/SRPMS/vixie-cron-3.0.1-37.4.2.src.rpm

Red Hat Linux 5.2:

Intel:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/i386/vixie-cron-3.0.1-37.5.2.i386.rpm

Alpha:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/alpha/vixie-cron-3.0.1-37.5.2.alpha.rpm

Sparc:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/sparc/vixie-cron-3.0.1-37.5.2.sparc.rpm

Source packages:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/5.2/SRPMS/vixie-cron-3.0.1-37.5.2.src.rpm

Red Hat Linux 6.0:

Intel:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/i386/vixie-cron-3.0.1-38.i386.rpm

Alpha:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/alpha/vixie-cron-3.0.1-38.alpha.rpm

Sparc:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/sparc/vixie-cron-3.0.1-38.sparc.rpm

Source packages:
rpm -Uvh ftp://ftp.redhat.com/redhat/updates/6.0/SRPMS/vixie-cron-3.0.1-38.src.rpm

7. Problem description:

By creating a crontab that runs with a specially formatted
'MAILTO' environment variable, it is possible for local users
to overflow a fixed-length buffer in the cron daemon's
cron_popen() function. Since the cron daemon runs as root,
it would be theoretcially possible for local users to use
this buffer overflow to gain root privilege.

Also, it was possible to use specially formatted 'MAILTO'
environment variables to send commands to sendmail.

(1999-08-25)
The original pacakges released had the following problems:
- Some legitimate e-mail addresses in "MAILTO" could be
  rejected.
- The Red Hat Linux 4.2 and 5.2 packages shipped with logrotate
  scripts that contained options not present in the logrotate
  that shipped with those versions.
- The Red Hat Linux 4.2 (i386 and SPARC) packages did not correctly
  reset the SIGCHLD handler, causing zombie processes to be created.

Users who experience these problems should upgrade to the newer
pacakges. There are no known security issues with the previous
errata packages.

Thanks go to Tymm Twillman, Martin Schulze, Pawel Veselov and others
for noting and providing some fixes for the vulnerabilities.

8. Solution:

For each RPM for your particular architecture, run:
 
rpm -Uvh <filename>
 
where filename is the name of the RPM.

9. Verification:

MD5 sum                           Package Name
--------------------------------------------------------------------------
e84b81e4c950add3b8565c91a9565807  i386/vixie-cron-3.0.1-37.4.2.i386.rpm
ecbc5c1b1c8bf72dd15319de5bf64292  alpha/vixie-cron-3.0.1-37.4.2.alpha.rpm
6825a04bf5dbf5dfbddad5221bd14489  sparc/vixie-cron-3.0.1-37.4.2.sparc.rpm
6365d813ef298479e35450c74862fab8  SRPMS/vixie-cron-3.0.1-37.4.2.src.rpm

88e5b200468c66c264283be01f674d4d  i386/vixie-cron-3.0.1-37.5.2.i386.rpm
b014e9335c7644484462fb0d2f86afa8  alpha/vixie-cron-3.0.1-37.5.2.alpha.rpm
850c86e7972e54b3d025e3fe3e7d8464  sparc/vixie-cron-3.0.1-37.5.2.sparc.rpm
64fa16237dc7aea30c58e9a6d1774d9e  SRPMS/vixie-cron-3.0.1-37.5.2.src.rpm

804bec06a0f2b25665c9f77b0c03cf4e  i386/vixie-cron-3.0.1-38.i386.rpm
fd3e80ae1c8a2ab84bcbcfe338fe8a92  alpha/vixie-cron-3.0.1-38.alpha.rpm
587e2cee6ab190f6bf9d1727b1bc48bc  sparc/vixie-cron-3.0.1-38.sparc.rpm
1197fe2e1db1591221a27738c2d812d4  SRPMS/vixie-cron-3.0.1-38.src.rpm


These packages are PGP signed by Red Hat Inc. for security.  Our key
is available at:
 
http://www.redhat.com/corp/contact.html
 
You can verify each package with the following command:
 
rpm --checksig  <filename>
 
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
 
rpm --checksig --nopgp <filename>

10. References:




-- 
         To unsubscribe: mail redhat-watch-list-request@redhat.com with 
                       "unsubscribe" as the Subject.