[RHSA-2012:0304-03] Low: vixie-cron security, bug fix, and enhancement update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Low: vixie-cron security, bug fix, and enhancement update

Advisory ID: RHSA-2012:0304-03

Product: Red Hat Enterprise Linux

Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0304.html

Issue date: 2012-02-21

Keywords: orphan, pam, pie

CVE Names: CVE-2010-0424

=====================================================================

 

1. Summary:

 

An updated vixie-cron package that fixes one security issue, several bugs,

and adds one enhancement is now available for Red Hat Enterprise Linux 5.

 

The Red Hat Security Response Team has rated this update as having low

security impact. A Common Vulnerability Scoring System (CVSS) base score,

which gives a detailed severity rating, is available from the CVE link in

the References section.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

 

3. Description:

 

The vixie-cron package contains the Vixie version of cron. Cron is a

standard UNIX daemon that runs specified programs at scheduled times. The

vixie-cron package adds improved security and more powerful configuration

options to the standard version of cron.

 

A race condition was found in the way the crontab program performed file

time stamp updates on a temporary file created when editing a user crontab

file. A local attacker could use this flaw to change the modification time

of arbitrary system files via a symbolic link attack. (CVE-2010-0424)

 

Red Hat would like to thank Dan Rosenberg for reporting this issue.

 

This update also fixes the following bugs:

 

* Cron jobs of users with home directories mounted on a Lightweight

Directory Access Protocol (LDAP) server or Network File System (NFS) were

often refused because jobs were marked as orphaned (typically due to a

temporary NSS lookup failure, when NIS and LDAP servers were unreachable).

With this update, a database of orphans is created, and cron jobs are

performed as expected. (BZ#455664)

 

* Previously, cron did not log any errors if a cron job file located in the

/etc/cron.d/ directory contained invalid entries. An upstream patch has

been applied to address this problem and invalid entries in the cron job

files now produce warning messages. (BZ#460070)

 

* Previously, the " ( -at -) reboot" crontab macro incorrectly ran jobs when the

crond daemon was restarted. If the user used the macro on multiple

machines, all entries with the " ( -at -) reboot" option were executed every time

the crond daemon was restarted. With this update, jobs are executed only

when the machine is rebooted. (BZ#476972)

 

* The crontab utility is now compiled as a position-independent executable

(PIE), which enhances the security of the system. (BZ#480930)

 

* When the parent crond daemon was stopped, but a child crond daemon was

running (executing a program), the "service crond status" command

incorrectly reported that crond was running. The source code has been

modified, and the "service crond status" command now correctly reports that

crond is stopped. (BZ#529632)

 

* According to the pam(8) manual page, the cron daemon, crond, supports

access control with PAM (Pluggable Authentication Module). However, the PAM

configuration file for crond did not export environment variables correctly

and, consequently, setting PAM variables via cron did not work. This update

includes a corrected /etc/pam.d/crond file that exports environment

variables correctly. Setting pam variables via cron now works as documented

in the pam(8) manual page. (BZ#541189)

 

* Previously, the mcstransd daemon modified labels for the crond daemon.

When the crond daemon attempted to use the modified label and mcstransd was

not running, crond used an incorrect label. Consequently, Security-Enhanced

Linux (SELinux) denials filled up the cron log, no jobs were executed, and

crond had to be restarted. With this update, both mcstransd and crond use

raw SELinux labels, which prevents the problem. (BZ#625016)

 

* Previously, the crontab(1) and cron(8) manual pages contained multiple

typographical errors. This update fixes those errors. (BZ#699620,

BZ#699621)

 

In addition, this update adds the following enhancement:

 

* Previously, the crontab utility did not use the Pluggable Authentication

Module (PAM) for verification of users. As a consequence, a user could

access crontab even if access had been restricted (usually by being denied

in the access.conf file). With this update, crontab returns an error

message that the user is not allowed to access crontab because of PAM

configuration. (BZ#249512)

 

All vixie-cron users should upgrade to this updated package, which resolves

these issues and adds this enhancement.

 

4. Solution:

 

Before applying this update, make sure all previously-released errata

relevant to your system have been applied.

 

This update is available via the Red Hat Network. Details on how to

use the Red Hat Network to apply this update are available at

https://access.redhat.com/kb/docs/DOC-11259

 

5. Bugs fixed (http://bugzilla.redhat.com/):

 

455664 - Adoptions at the crontab orphanage needed

460070 - cronjobs in /etc/cron.d entries with an invalid username produce no error in the logs

476972 - crontab error with ( -at -) reboot entry

480930 - Make crontab a PIE

529632 - [PATCH] "service crond status" return invalid status

541189 - cron and /etc/security/pam_env.conf problem

565809 - CVE-2010-0424 vixie-cron, cronie: Race condition by setting timestamp of user's crontab file, when editing the file

625016 - crond requires a restart if mcstransd is stopped

699620 - Typo in patch for crond manpage removes mention of cron.d

699621 - man page typo -- two be -- should be not two be's

 

6. Package List:

 

Red Hat Enterprise Linux Desktop (v. 5 client):

 

Source:

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/vixie-cron-4.1-81.el5.src.rpm

 

i386:

vixie-cron-4.1-81.el5.i386.rpm

vixie-cron-debuginfo-4.1-81.el5.i386.rpm

 

x86_64:

vixie-cron-4.1-81.el5.x86_64.rpm

vixie-cron-debuginfo-4.1-81.el5.x86_64.rpm

 

Red Hat Enterprise Linux (v. 5 server):

 

Source:

ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/vixie-cron-4.1-81.el5.src.rpm

 

i386:

vixie-cron-4.1-81.el5.i386.rpm

vixie-cron-debuginfo-4.1-81.el5.i386.rpm

 

ia64:

vixie-cron-4.1-81.el5.ia64.rpm

vixie-cron-debuginfo-4.1-81.el5.ia64.rpm

 

ppc:

vixie-cron-4.1-81.el5.ppc.rpm

vixie-cron-debuginfo-4.1-81.el5.ppc.rpm

 

s390x:

vixie-cron-4.1-81.el5.s390x.rpm

vixie-cron-debuginfo-4.1-81.el5.s390x.rpm

 

x86_64:

vixie-cron-4.1-81.el5.x86_64.rpm

vixie-cron-debuginfo-4.1-81.el5.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/#package

 

7. References:

 

https://www.redhat.com/security/data/cve/CVE-2010-0424.html

https://access.redhat.com/security/updates/classification/#low

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2012 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.4 (GNU/Linux)

 

iD8DBQFPQyTdXlSAg2UNWIIRAsf/AJ0Rnii8h7UKh/bB9cHIRiKzVWQQ9QCfY/YT

EAoMEyKMLLcrhkaqoQEkMW0=

=LyP3

-----END PGP SIGNATURE-----

 

 

--