Secunia

Karol Wiêsek has discovered a vulnerability in vixie-cron on Fedora Core, which can be exploited by malicious, local users to read arbitrary cron files.

The vulnerability is caused due to a missing check of the temporary file edited by the user. This can be exploited by removing the temporary cron file while it is being edited and replace it with a symbolic link to arbitrary cron files.

The vulnerability has been confirmed on a fully updated Fedora Core 3 system.

NOTE: This issue appears to be similar to an issue, which was reported in vixie-cron in year 2000 and subsequently fixed in some other distributions.

Solution
Apply updated packages.
Further details available in Customer Area

Provided and/or discovered by
Karol Wiêsek

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area