[ GLSA 201311-04 ] Vixie cron: Denial of Service

[GLSA]

Gentoo Linux Security Advisory

Title: Vixie cron: Denial of Service (GLSA 201311-04)
Severity: normal
Exploitable: local
Date: November 07, 2013
Bug(s): #308055
ID: 201311-04

Synopsis

A vulnerability has been found in Vixie cron, allowing local
attackers to conduct symlink attacks.


Background

Paul Vixie’s cron daemon, a fully featured crond implementation.

Affected Packages

Package: sys-process/vixie-cron
Vulnerable: < 4.1-r14
Unaffected: >= 4.1-r14
Architectures: All supported architectures


Description

Vixie cron contains a race condition relating to atime and mtime values
of temporary files.


Impact

A local attacker could change the modification time of files, possibly
resulting in a Denial of Service condition via a symlink attack.


Workaround

There is no known workaround at this time.

Resolution

All Vixie cron users should upgrade to the latest version: