CVE-2012-6110 bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessin...
LowCVSS 2.1
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/bcron(Debian:12) | < 0.09-13 | 0.09-13 |
| debian/bcron(Debian:13) | < 0.09-13 | 0.09-13 |
| debian/bcron(Debian:14) | < 0.09-13 | 0.09-13 |
| bcron project bcron exec | <= 0.09 | No fix listed |
| bcron project bcron exec | = 0.04 | No fix listed |
| bcron project bcron exec | = 0.05 | No fix listed |
| bcron project bcron exec | = 0.06 | No fix listed |
| bcron project bcron exec | = 0.07 | No fix listed |
| bcron project bcron exec | = 0.08 | No fix listed |
References
- Debian Security Tracker CVE-2012-6110 vendor-advisory
- [oss-security] 20130116 bcron: cron jobs get access to the temporary output files from all other jobs that are still running mailing-list
- untroubled.org
- bugs.debian.org exploit patch
- bcron-bcronexe-priv-esc(81383) vdb-entry
- bugs.debian.org issue-tracking