Synopsis

Low: vixie-cron security, bug fix, and enhancement update

Type/Severity

Security Advisory: Low

Topic

An updated vixie-cron package that fixes one security issue, several bugs,
and adds one enhancement is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

The vixie-cron package contains the Vixie version of cron. Cron is a
standard UNIX daemon that runs specified programs at scheduled times. The
vixie-cron package adds improved security and more powerful configuration
options to the standard version of cron.

A race condition was found in the way the crontab program performed file
time stamp updates on a temporary file created when editing a user crontab
file. A local attacker could use this flaw to change the modification time
of arbitrary system files via a symbolic link attack. (CVE-2010-0424)

Red Hat would like to thank Dan Rosenberg for reporting this issue.

This update also fixes the following bugs:

• Cron jobs of users with home directories mounted on a Lightweight
  Directory Access Protocol (LDAP) server or Network File System (NFS) were
  often refused because jobs were marked as orphaned (typically due to a
  temporary NSS lookup failure, when NIS and LDAP servers were unreachable).
  With this update, a database of orphans is created, and cron jobs are
  performed as expected. (BZ#455664)
  
• Previously, cron did not log any errors if a cron job file located in the
  /etc/cron.d/ directory contained invalid entries. An upstream patch has
  been applied to address this problem and invalid entries in the cron job
  files now produce warning messages. (BZ#460070)
  
• Previously, the "@reboot" crontab macro incorrectly ran jobs when the
  crond daemon was restarted. If the user used the macro on multiple
  machines, all entries with the "@reboot" option were executed every time
  the crond daemon was restarted. With this update, jobs are executed only
  when the machine is rebooted. (BZ#476972)
  
• The crontab utility is now compiled as a position-independent executable
  (PIE), which enhances the security of the system. (BZ#480930)
  
• When the parent crond daemon was stopped, but a child crond daemon was
  running (executing a program), the "service crond status" command
  incorrectly reported that crond was running. The source code has been
  modified, and the "service crond status" command now correctly reports that
  crond is stopped. (BZ#529632)
  
• According to the pam(8) manual page, the cron daemon, crond, supports
  access control with PAM (Pluggable Authentication Module). However, the PAM
  configuration file for crond did not export environment variables correctly
  and, consequently, setting PAM variables via cron did not work. This update
  includes a corrected /etc/pam.d/crond file that exports environment
  variables correctly. Setting pam variables via cron now works as documented
  in the pam(8) manual page. (BZ#541189)
  
• Previously, the mcstransd daemon modified labels for the crond daemon.
  When the crond daemon attempted to use the modified label and mcstransd was
  not running, crond used an incorrect label. Consequently, Security-Enhanced
  Linux (SELinux) denials filled up the cron log, no jobs were executed, and
  crond had to be restarted. With this update, both mcstransd and crond use
  raw SELinux labels, which prevents the problem. (BZ#625016)
  
• Previously, the crontab(1) and cron(8) manual pages contained multiple
  typographical errors. This update fixes those errors. (BZ#699620,
  BZ#699621)
  

In addition, this update adds the following enhancement:

• Previously, the crontab utility did not use the Pluggable Authentication
  Module (PAM) for verification of users. As a consequence, a user could
  access crontab even if access had been restricted (usually by being denied
  in the access.conf file). With this update, crontab returns an error
  message that the user is not allowed to access crontab because of PAM
  configuration. (BZ#249512)
  

All vixie-cron users should upgrade to this updated package, which resolves
these issues and adds this enhancement.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 455664 - Adoptions at the crontab orphanage needed
• BZ - 460070 - cronjobs in /etc/cron.d entries with an invalid username produce no error in the logs
• BZ - 476972 - crontab error with @reboot entry
• BZ - 480930 - Make crontab a PIE
• BZ - 529632 - [PATCH] "service crond status" return invalid status
• BZ - 541189 - cron and /etc/security/pam_env.conf problem
• BZ - 565809 - CVE-2010-0424 vixie-cron, cronie: Race condition by setting timestamp of user's crontab file, when editing the file
• BZ - 625016 - crond requires a restart if mcstransd is stopped
• BZ - 699620 - Typo in patch for crond manpage removes mention of cron.d
• BZ - 699621 - man page typo -- two be -- should be not two be's ;)

CVEs

• CVE-2010-0424

References

• https://access.redhat.com/security/updates/classification/#low

Red Hat Enterprise Linux Server 5

SRPM
vixie-cron-4.1-81.el5.src.rpm	SHA-256: 1314bcbd79c68788bb1ca405d47c4a44fb6889c0a0749b4f451b383016e78c73
x86_64
vixie-cron-4.1-81.el5.x86_64.rpm	SHA-256: 680c91f262dc98a4a5533f6d5b7a1b611a2efa06667106f4dbf7cedc0e5195e3
vixie-cron-debuginfo-4.1-81.el5.x86_64.rpm	SHA-256: 1f931ccf283cc289e0b30cee4dfc8c5c53d5a04df9de9a019cdfaa1c23119f06
ia64
vixie-cron-4.1-81.el5.ia64.rpm	SHA-256: 730fa12207e619c753fb47a326e15d7dc34dce7b1734c1e3d317d0b42ad56e59
vixie-cron-debuginfo-4.1-81.el5.ia64.rpm	SHA-256: 879e331f7be520c265aed8c37721670435c175ba30943d3874d25661078a158a
i386
vixie-cron-4.1-81.el5.i386.rpm	SHA-256: 0069d760e8ba0b1c9439baeddb769c23d32992505efcefe81c4d688233483619
vixie-cron-debuginfo-4.1-81.el5.i386.rpm	SHA-256: e5a6def92436576f661c2f13d579374f5ca20e01dcc51396af24f7ed60a8a078

Red Hat Enterprise Linux Workstation 5

SRPM
vixie-cron-4.1-81.el5.src.rpm	SHA-256: 1314bcbd79c68788bb1ca405d47c4a44fb6889c0a0749b4f451b383016e78c73
x86_64
vixie-cron-4.1-81.el5.x86_64.rpm	SHA-256: 680c91f262dc98a4a5533f6d5b7a1b611a2efa06667106f4dbf7cedc0e5195e3
vixie-cron-debuginfo-4.1-81.el5.x86_64.rpm	SHA-256: 1f931ccf283cc289e0b30cee4dfc8c5c53d5a04df9de9a019cdfaa1c23119f06
i386
vixie-cron-4.1-81.el5.i386.rpm	SHA-256: 0069d760e8ba0b1c9439baeddb769c23d32992505efcefe81c4d688233483619
vixie-cron-debuginfo-4.1-81.el5.i386.rpm	SHA-256: e5a6def92436576f661c2f13d579374f5ca20e01dcc51396af24f7ed60a8a078

Red Hat Enterprise Linux Desktop 5

SRPM
vixie-cron-4.1-81.el5.src.rpm	SHA-256: 1314bcbd79c68788bb1ca405d47c4a44fb6889c0a0749b4f451b383016e78c73
x86_64
vixie-cron-4.1-81.el5.x86_64.rpm	SHA-256: 680c91f262dc98a4a5533f6d5b7a1b611a2efa06667106f4dbf7cedc0e5195e3
vixie-cron-debuginfo-4.1-81.el5.x86_64.rpm	SHA-256: 1f931ccf283cc289e0b30cee4dfc8c5c53d5a04df9de9a019cdfaa1c23119f06
i386
vixie-cron-4.1-81.el5.i386.rpm	SHA-256: 0069d760e8ba0b1c9439baeddb769c23d32992505efcefe81c4d688233483619
vixie-cron-debuginfo-4.1-81.el5.i386.rpm	SHA-256: e5a6def92436576f661c2f13d579374f5ca20e01dcc51396af24f7ed60a8a078

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
vixie-cron-4.1-81.el5.src.rpm	SHA-256: 1314bcbd79c68788bb1ca405d47c4a44fb6889c0a0749b4f451b383016e78c73
s390x
vixie-cron-4.1-81.el5.s390x.rpm	SHA-256: 6e54e5fa4f5a59e8a847245452117fdfa1a639c6b01f54cc2e67509d6f1e3710
vixie-cron-debuginfo-4.1-81.el5.s390x.rpm	SHA-256: 57ff90f49eb34858a9c2b3f8f26b2c76ea34f252f4f567362ea723e84205c6d7

Red Hat Enterprise Linux for Power, big endian 5

SRPM
vixie-cron-4.1-81.el5.src.rpm	SHA-256: 1314bcbd79c68788bb1ca405d47c4a44fb6889c0a0749b4f451b383016e78c73
ppc
vixie-cron-4.1-81.el5.ppc.rpm	SHA-256: b0df05b3e9621aae7562ff47b2912d5fc1d475df8a919a7189d5c70594465d63
vixie-cron-debuginfo-4.1-81.el5.ppc.rpm	SHA-256: 1f4ecb9dd79acd59d69feb719d2c06b7a400048f4069ec56b1391dee89f0ebec

Red Hat Enterprise Linux Server from RHUI 5

SRPM
vixie-cron-4.1-81.el5.src.rpm	SHA-256: 1314bcbd79c68788bb1ca405d47c4a44fb6889c0a0749b4f451b383016e78c73
x86_64
vixie-cron-4.1-81.el5.x86_64.rpm	SHA-256: 680c91f262dc98a4a5533f6d5b7a1b611a2efa06667106f4dbf7cedc0e5195e3
vixie-cron-debuginfo-4.1-81.el5.x86_64.rpm	SHA-256: 1f931ccf283cc289e0b30cee4dfc8c5c53d5a04df9de9a019cdfaa1c23119f06
i386
vixie-cron-4.1-81.el5.i386.rpm	SHA-256: 0069d760e8ba0b1c9439baeddb769c23d32992505efcefe81c4d688233483619
vixie-cron-debuginfo-4.1-81.el5.i386.rpm	SHA-256: e5a6def92436576f661c2f13d579374f5ca20e01dcc51396af24f7ed60a8a078