PT-2002-1738 · Isc · Crontab

Published 2002-07-26 · Updated 2016-10-18 · CVE-2002-0716

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions crontab versions 5.0.5 through 5.0.6

Description The issue is related to a format string vulnerability in crontab, which allows local users to gain privileges. This is achieved by using format string specifiers in the file name argument.

Recommendations For versions 5.0.5 and 5.0.6, consider restricting access to the crontab utility until a fix is available. As a temporary workaround, avoid using format string specifiers in file name arguments to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-0716

Affected Products

Crontab

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-0716 · Security Note
• http://marc.info/?l=bugtraq&m=102323070305101&w=2 · Note
• http://iss.net/security_center/static/9271.php · Note
• http://marc.info/?l=vuln-dev&m=102323386107641&w=2 · Note
• http://securityfocus.com/bid/4938 · Note