PT-2024-30615 · Unknown+1 · Vixie Cron+1

Alex Radocea + 1 · Published 2024-08-19 · Updated 2024-08-26 · CVE-2024-43688

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions vixie cron versions prior to 9cc8ab1 OpenBSD versions 7.4 and 7.5

Description The issue allows a heap-based buffer underflow and memory corruption in cron/entry.c. This was introduced during a May 2023 refactoring.

Recommendations For vixie cron versions prior to 9cc8ab1, update to a version that includes the fix for the heap-based buffer underflow. For OpenBSD versions 7.4 and 7.5, update the vixie cron package to a version that includes the fix for the heap-based buffer underflow. As a temporary workaround, consider restricting access to the set range() function in crontab until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-43688

Affected Products

Openbsd

Vixie Cron

References · 14

• https://osv.dev/vulnerability/CVE-2024-43688 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43688 · Security Note
• https://github.com/vixie/cron/commit/9cc8ab1087bb9ab861dd5595c41200683c9f6712 · Note
• https://t.me/cvenotify/92096 · Telegram Post
• https://t.me/cvedetector/3605 · Telegram Post
• https://twitter.com/oktsec/status/1825823654275346453 · Twitter Post
• https://supernetworks.org/CVE-2024-43688/openbsd-cron-heap-underflow.txt · Note
• https://twitter.com/lcheylus/status/1826698103535112307 · Twitter Post
• https://supernetworks.org/advisories/CVE-2024-43688-openbsd-cron-heap-underflow.txt · Note
• https://twitter.com/circl_lu/status/1825792200388530446 · Twitter Post
• https://t.me/cvenotify/91233 · Telegram Post
• https://twitter.com/CVEnew/status/1825772552263971137 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1825845614967427257 · Twitter Post
• https://twitter.com/TechTweetBot/status/1825750018969436464 · Twitter Post