ID de Prueba:	1.3.6.1.4.1.25623.1.0.870550
Categoría:	Red Hat Local Security Checks
Título:	RedHat Update for vixie-cron RHSA-2012:0304-03
Resumen:	The remote host is missing an update for the 'vixie-cron'; package(s) announced via the referenced advisory.
Descripción:	Summary: The remote host is missing an update for the 'vixie-cron' package(s) announced via the referenced advisory. Vulnerability Insight: The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times. The vixie-cron package adds improved security and more powerful configuration options to the standard version of cron. A race condition was found in the way the crontab program performed file time stamp updates on a temporary file created when editing a user crontab file. A local attacker could use this flaw to change the modification time of arbitrary system files via a symbolic link attack. (CVE-2010-0424) Red Hat would like to thank Dan Rosenberg for reporting this issue. This update also fixes the following bugs: * Cron jobs of users with home directories mounted on a Lightweight Directory Access Protocol (LDAP) server or Network File System (NFS) were often refused because jobs were marked as orphaned (typically due to a temporary NSS lookup failure, when NIS and LDAP servers were unreachable). With this update, a database of orphans is created, and cron jobs are performed as expected. (BZ#455664) * Previously, cron did not log any errors if a cron job file located in the /etc/cron.d/ directory contained invalid entries. An upstream patch has been applied to address this problem and invalid entries in the cron job files now produce warning messages. (BZ#460070) * Previously, the '@reboot' crontab macro incorrectly ran jobs when the crond daemon was restarted. If the user used the macro on multiple machines, all entries with the '@reboot' option were executed every time the crond daemon was restarted. With this update, jobs are executed only when the machine is rebooted. (BZ#476972) * The crontab utility is now compiled as a position-independent executable (PIE), which enhances the security of the system. (BZ#480930) * When the parent crond daemon was stopped, but a child crond daemon was running (executing a program), the 'service crond status' command incorrectly reported that crond was running. The source code has been modified, and the 'service crond status' command now correctly reports that crond is stopped. (BZ#529632) * According to the pam(8) manual page, the cron daemon, crond, supports access control with PAM (Pluggable Authentication Module). However, the PAM configuration file for crond did not export environment variables correctly and, consequently, setting PAM variables via cron did not work. This update includes a corrected /etc/pam.d/crond file that exports environmen ... Description truncated, please see the referenced URL(s) for more information. Affected Software/OS: vixie-cron on Red Hat Enterprise Linux (v. 5 server) Solution: Please Install the Updated Packages. CVSS Score: 3.3 CVSS Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2010-0424 38391 http://www.securityfocus.com/bid/38391 38700 http://secunia.com/advisories/38700 38741 http://secunia.com/advisories/38741 48104 http://secunia.com/advisories/48104 FEDORA-2010-2751 http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035762.html http://git.fedorahosted.org/git/cronie.git?p=cronie.git%3Ba=commit%3Bh=9e4a8fa5f9171fb724981f53879c9b20264aeb61 https://bugzilla.redhat.com/show_bug.cgi?id=565809
Copyright	Copyright (C) 2012 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.