PT-2001-1010 · Isc+1 · Vixie Cron+1

Published 2001-04-17 · Updated 2017-10-10 · CVE-2001-0559

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vixie cron versions 3.0.1 and earlier

Description The issue is related to a problem in crontab where it does not properly drop privileges after a failed parsing of a modification operation. This could allow a local attacker to gain additional privileges when an editor is called to correct the error. Multiple vulnerabilities in the cron package of the Debian GNU/Linux operating system can be exploited by a local attacker, potentially leading to breaches of confidentiality, integrity, and availability of protected information.

Recommendations For Vixie cron versions 3.0.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-02970

CVE-2001-0559

Affected Products

Debian

Vixie Cron

References · 12

• 🔥 https://exploit-db.com/exploits/20823 · Exploit
• 🔥 http://securityfocus.com/bid/2687 · Exploit
• 🔥 http://securityfocus.com/archive/1/183029 · Exploit
• 🔥 https://exploit-db.com/exploits/20822 · Exploit
• http://debian.org/security/2001/dsa-054 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0559 · Security Note
• http://linux-mandrake.com/en/security/2001/MDKSA-2001-050.php3 · Vendor Advisory
• http://novell.com/linux/security/advisories/2001_017_cron_txt.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2001-0559 · Security Note
• http://debian.org/security/dsa-054 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/6508 · Note