Hash: SHA1

             AUSCERT External Security Bulletin Redistribution

         Low: vixie-cron security, bug fix, and enhancement update
                             22 February 2012


        AusCERT Security Bulletin Summary

Product:           vixie-cron
Publisher:         Red Hat
Operating System:  Red Hat Enterprise Linux Server 5
                   Red Hat Enterprise Linux WS/Desktop 5
Impact/Access:     Modify Arbitrary Files -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2010-0424  

Reference:         ESB-2012.0202

Original Bulletin: 

- --------------------------BEGIN INCLUDED TEXT--------------------

Hash: SHA1

                   Red Hat Security Advisory

Synopsis:          Low: vixie-cron security, bug fix, and enhancement update
Advisory ID:       RHSA-2012:0304-03
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2012-0304.html
Issue date:        2012-02-21
Keywords:          orphan, pam, pie
CVE Names:         CVE-2010-0424 

1. Summary:

An updated vixie-cron package that fixes one security issue, several bugs,
and adds one enhancement is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

3. Description:

The vixie-cron package contains the Vixie version of cron. Cron is a
standard UNIX daemon that runs specified programs at scheduled times. The
vixie-cron package adds improved security and more powerful configuration
options to the standard version of cron.

A race condition was found in the way the crontab program performed file
time stamp updates on a temporary file created when editing a user crontab
file. A local attacker could use this flaw to change the modification time
of arbitrary system files via a symbolic link attack. (CVE-2010-0424)

Red Hat would like to thank Dan Rosenberg for reporting this issue.

This update also fixes the following bugs:

* Cron jobs of users with home directories mounted on a Lightweight
Directory Access Protocol (LDAP) server or Network File System (NFS) were
often refused because jobs were marked as orphaned (typically due to a
temporary NSS lookup failure, when NIS and LDAP servers were unreachable).
With this update, a database of orphans is created, and cron jobs are
performed as expected. (BZ#455664)

* Previously, cron did not log any errors if a cron job file located in the
/etc/cron.d/ directory contained invalid entries. An upstream patch has
been applied to address this problem and invalid entries in the cron job
files now produce warning messages. (BZ#460070)

* Previously, the "@reboot" crontab macro incorrectly ran jobs when the
crond daemon was restarted. If the user used the macro on multiple
machines, all entries with the "@reboot" option were executed every time
the crond daemon was restarted. With this update, jobs are executed only
when the machine is rebooted. (BZ#476972)

* The crontab utility is now compiled as a position-independent executable
(PIE), which enhances the security of the system. (BZ#480930)

* When the parent crond daemon was stopped, but a child crond daemon was
running (executing a program), the "service crond status" command
incorrectly reported that crond was running. The source code has been
modified, and the "service crond status" command now correctly reports that
crond is stopped. (BZ#529632)

* According to the pam(8) manual page, the cron daemon, crond, supports
access control with PAM (Pluggable Authentication Module). However, the PAM
configuration file for crond did not export environment variables correctly
and, consequently, setting PAM variables via cron did not work. This update
includes a corrected /etc/pam.d/crond file that exports environment
variables correctly. Setting pam variables via cron now works as documented
in the pam(8) manual page. (BZ#541189)

* Previously, the mcstransd daemon modified labels for the crond daemon.
When the crond daemon attempted to use the modified label and mcstransd was
not running, crond used an incorrect label. Consequently, Security-Enhanced
Linux (SELinux) denials filled up the cron log, no jobs were executed, and
crond had to be restarted. With this update, both mcstransd and crond use
raw SELinux labels, which prevents the problem. (BZ#625016)

* Previously, the crontab(1) and cron(8) manual pages contained multiple
typographical errors. This update fixes those errors. (BZ#699620,

In addition, this update adds the following enhancement:

* Previously, the crontab utility did not use the Pluggable Authentication
Module (PAM) for verification of users. As a consequence, a user could
access crontab even if access had been restricted (usually by being denied
in the access.conf file). With this update, crontab returns an error
message that the user is not allowed to access crontab because of PAM
configuration. (BZ#249512)

All vixie-cron users should upgrade to this updated package, which resolves
these issues and adds this enhancement.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at

5. Bugs fixed (http://bugzilla.redhat.com/):

455664 - Adoptions at the crontab orphanage needed
460070 - cronjobs in /etc/cron.d entries with an invalid username produce no error in the logs
476972 - crontab error with @reboot entry
480930 - Make crontab a PIE
529632 - [PATCH] "service crond status" return invalid status
541189 - cron and /etc/security/pam_env.conf problem
565809 - CVE-2010-0424 vixie-cron, cronie: Race condition by setting timestamp of user's crontab file, when editing the file
625016 - crond requires a restart if mcstransd is stopped
699620 - Typo in patch for crond manpage removes mention of cron.d
699621 - man page typo -- two be -- should be not two be's    ;)

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):




Red Hat Enterprise Linux (v. 5 server):







These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from

7. References:


8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2012 Red Hat, Inc.
Version: GnuPG v1.4.4 (GNU/Linux)


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
Comment: http://www.auscert.org.au/render.html?it=1967