exploits , vulnerabilities , articles , Vixie Cron crontab Privilege Lowering Failure Vulnerability

Title	Vixie Cron crontab Privilege Lowering Failure Vulnerability
Published	2001-05-07-12:00AM
Updated	2003-10-03-07:49PM
Class	Serialization Error
CVE	CVE-2001-0559
Remote	No
Local	Yes
Credit	Initially posted to Bugtraq in a Debian Security Advisory (DSA-054-1) on May 7, 2001. Reportedly discovered by Sebastian Krahmer <krahmer@suse.de>.
Vulnerable	Paul Vixie Vixie Cron 3.0.1 S.u.S.E. Linux 7.1 S.u.S.E. Linux 7.1 ppc S.u.S.E. Linux 7.1 sparc S.u.S.E. Linux 7.1 x86 Paul Vixie Vixie Cron 3.0 pl1 Conectiva Linux 6.0 Conectiva Linux 7.0 Conectiva Linux 8.0 Debian Linux 2.2 Debian Linux 2.2 68k Debian Linux 2.2 alpha Debian Linux 2.2 arm Debian Linux 2.2 powerpc Debian Linux 2.2 sparc Progeny Debian 1.0
Not Vulnerable	S.u.S.E. Linux 7.1 alpha RedHat Linux 7.1 RedHat Linux 7.0 RedHat Linux 6.2 RedHat Linux 6.1 Paul Vixie Vixie Cron 3.0 pl1-67 Debian Linux 2.2 Debian Linux 2.2 68k Debian Linux 2.2 alpha Debian Linux 2.2 arm Debian Linux 2.2 powerpc Debian Linux 2.2 sparc
Code	During SIA analysis of this vulnerability, Cade Cairns <cairnsc@SecurityDot.net> wrote proof-of-concept exploit code. Another exploit written by Michael Zalewski <lcamtuf@coredump.cx> and Sebastian Krahmer <krahmer@security.is> has also been submitted. /data/vulnerabilities/exploits/cronboom.sh /data/vulnerabilities/exploits/corntab
TXT

Vulnerabilities - newest 10 RSS | More

• 2009-12-17 Drupal Sections Module HTML Injection Vulnerability
• 2009-12-17 Mozilla Firefox and SeaMonkey Theora Video Library Remote Integer Overflow Vulnerability
• 2009-12-17 Mozilla Firefox and Sea Monkey Insecure Protocol Location Bar Spoofing Vulnerability
• 2009-12-17 Mozilla Firefox and Sea Monkey Content Injection Spoofing Vulnerability
• 2009-12-17 Mozilla Firefox/SeaMonkey GeckoActiveXObject Exception Message COM Object Enumeration Vulnerability
• 2009-12-16 ZABBIX Denial Of Service and SQL Injection Vulnerabilities
• 2009-12-16 IBM WebSphere Application Server JNDI Remote Information Disclosure Vulnerability
• 2009-12-16 Horde Application Framework Administration Interface Cross-Site Scripting Vulnerability
• 2009-12-16 Mozilla Firefox and SeaMonkey MFSA 2009-65 through -71 Multiple Vulnerabilities
• 2009-12-16 Merkaartor Insecure Temporary File Creation Vulnerability

• Vulnerabilities
• Exploits
• News
• Articles

Copyright 2007, SecurityDot
Thu, 17 Dec 2009 12:15:32 +0000