Описание
In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| cron | fixed | 3.0pl1-129 | package | |
| cron | no-dsa | wheezy | package | |
| systemd-cron | fixed | 1.5.17-2 | package | |
| systemd-cron | no-dsa | bullseye | package | |
| systemd-cron | no-dsa | buster | package | |
| systemd-cron | no-dsa | stretch | package |
Примечания
https://www.openwall.com/lists/oss-security/2017/06/08/3
EPSS
Связанные уязвимости
In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.
In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.
In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.
Уязвимость демона-планировщика задач в UNIX-подобных операционных системах Cron, позволяющая нарушителю расширить привилегии
EPSS