Joined: 12 May 2004
|Posted: Thu Nov 07, 2013 3:26 am Post subject: [ GLSA 201311-04 ] Vixie cron: Denial of Service
|Gentoo Linux Security Advisory
Title: Vixie cron: Denial of Service (GLSA 201311-04)
Date: November 07, 2013
A vulnerability has been found in Vixie cron, allowing local
attackers to conduct symlink attacks.
Paul Vixie’s cron daemon, a fully featured crond implementation.
Vulnerable: < 4.1-r14
Unaffected: >= 4.1-r14
Architectures: All supported architectures
Vixie cron contains a race condition relating to atime and mtime values
of temporary files.
A local attacker could change the modification time of files, possibly
resulting in a Denial of Service condition via a symlink attack.
There is no known workaround at this time.
All Vixie cron users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-process/vixie-cron-4.1-r14"