ID de Prueba:	1.3.6.1.4.1.25623.1.0.55522
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2005:361
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2005:361. The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times. A bug was found in the way vixie-cron installs new crontab files. It is possible for a local attacker to execute the crontab command in such a way that they can view the contents of another user's crontab file. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1038 to this issue. Additionally, this update addresses the following issues: o Fixed improper limits on filename and command line lengths o Improved PAM access control conforming to EAL certification requirements o Improved reliability when running in a chroot environment o Mail recipient name checking disabled by default, can be re-enabled o Added '-p' permit all crontabs option to disable crontab mode checking All users of vixie-cron should upgrade to this updated package, which contains backported patches and is not vulnerable to these issues. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2005-361.html http://www.securityfocus.com/archive/1/395093 Risk factor : Medium CVSS Score: 2.1
Referencia Cruzada:	BugTraq ID: 13024 Common Vulnerability Exposure (CVE) ID: CVE-2005-1038 http://www.securityfocus.com/bid/13024 Bugtraq: 20050406 crontab from vixie-cron allows read other users crontabs (Google Search) http://www.securityfocus.com/archive/1/395093 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11104 http://www.redhat.com/support/errata/RHSA-2005-361.html http://www.redhat.com/support/errata/RHSA-2006-0117.html http://secunia.com/advisories/19532 http://secunia.com/advisories/20666 http://secunia.com/advisories/24995 SGI Security Advisory: 20060401-01-U ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U SuSE Security Announcement: SUSE-SR:2007:007 (Google Search) http://www.novell.com/linux/security/advisories/2007_007_suse.html
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.