Synopsis

vixie-cron security update

Type/Severity

Security Advisory: Important

Topic

Updated vixie-cron packages that fix a privilege escalation issue are now
available.

This update has been rated as having important security impact by the Red Hat
Security Response Team.

Description

The vixie-cron package contains the Vixie version of cron. Cron is a
standard UNIX daemon that runs specified programs at scheduled times.

A privilege escalation flaw was found in the way Vixie Cron runs programs;
vixie-cron does not properly verify an attempt to set the current process
user id succeeded. It was possible for a malicious local users who
exhausted certain limits to execute arbitrary commands as root via cron.
(CVE-2006-2607)

All users of vixie-cron should upgrade to these updated packages, which
contain a backported patch to correct this issue.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 193146 - CVE-2006-2607 Jobs start from root when pam_limits enabled

CVEs

• CVE-2006-2607

References

• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 4

SRPM
vixie-cron-4.1-44.EL4.src.rpm	SHA-256: a73d906af44975e0be4f64530fe1474b5c6c5b6517cc89a7aab04001f52b9773
x86_64
vixie-cron-4.1-44.EL4.x86_64.rpm	SHA-256: 0d5e99560fd3f4826ae177e3a28b98d1529fd1e90586d692c20f1c32550384e7
vixie-cron-4.1-44.EL4.x86_64.rpm	SHA-256: 0d5e99560fd3f4826ae177e3a28b98d1529fd1e90586d692c20f1c32550384e7
ia64
vixie-cron-4.1-44.EL4.ia64.rpm	SHA-256: 750b3ca91c64b15fce6ca8abcc301937af2d4af620139a5f1c2dc829659dfd71
vixie-cron-4.1-44.EL4.ia64.rpm	SHA-256: 750b3ca91c64b15fce6ca8abcc301937af2d4af620139a5f1c2dc829659dfd71
i386
vixie-cron-4.1-44.EL4.i386.rpm	SHA-256: b800515d530af1b7b60ab92df192a77175c6b9f7e6b88b94b2e43786466f2f47
vixie-cron-4.1-44.EL4.i386.rpm	SHA-256: b800515d530af1b7b60ab92df192a77175c6b9f7e6b88b94b2e43786466f2f47

Red Hat Enterprise Linux Workstation 4

SRPM
vixie-cron-4.1-44.EL4.src.rpm	SHA-256: a73d906af44975e0be4f64530fe1474b5c6c5b6517cc89a7aab04001f52b9773
x86_64
vixie-cron-4.1-44.EL4.x86_64.rpm	SHA-256: 0d5e99560fd3f4826ae177e3a28b98d1529fd1e90586d692c20f1c32550384e7
ia64
vixie-cron-4.1-44.EL4.ia64.rpm	SHA-256: 750b3ca91c64b15fce6ca8abcc301937af2d4af620139a5f1c2dc829659dfd71
i386
vixie-cron-4.1-44.EL4.i386.rpm	SHA-256: b800515d530af1b7b60ab92df192a77175c6b9f7e6b88b94b2e43786466f2f47

Red Hat Enterprise Linux Desktop 4

SRPM
vixie-cron-4.1-44.EL4.src.rpm	SHA-256: a73d906af44975e0be4f64530fe1474b5c6c5b6517cc89a7aab04001f52b9773
x86_64
vixie-cron-4.1-44.EL4.x86_64.rpm	SHA-256: 0d5e99560fd3f4826ae177e3a28b98d1529fd1e90586d692c20f1c32550384e7
i386
vixie-cron-4.1-44.EL4.i386.rpm	SHA-256: b800515d530af1b7b60ab92df192a77175c6b9f7e6b88b94b2e43786466f2f47

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
vixie-cron-4.1-44.EL4.src.rpm	SHA-256: a73d906af44975e0be4f64530fe1474b5c6c5b6517cc89a7aab04001f52b9773
s390x
vixie-cron-4.1-44.EL4.s390x.rpm	SHA-256: 2b7c2a5c529b06e869a0874bc6624df3673a908cea848d9444c692ba5639a0c6
s390
vixie-cron-4.1-44.EL4.s390.rpm	SHA-256: c18a720ab2a95053a9c10c923424efaddd4183fb0be47e02320b35e05d316a99

Red Hat Enterprise Linux for Power, big endian 4

SRPM
vixie-cron-4.1-44.EL4.src.rpm	SHA-256: a73d906af44975e0be4f64530fe1474b5c6c5b6517cc89a7aab04001f52b9773
ppc
vixie-cron-4.1-44.EL4.ppc.rpm	SHA-256: 2f140a0fb1a2f17e2178effdbb2d60edb3730aa96c511b63ec974fe89c2d26ff