CVE-2017-9525 In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks agai...
MediumCVSS 6.7
EPSS 0.55%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/cron(Debian:12) | < 3.0pl1-129 | 3.0pl1-129 |
| debian/cron(Debian:13) | < 3.0pl1-129 | 3.0pl1-129 |
| debian/cron(Debian:14) | < 3.0pl1-129 | 3.0pl1-129 |
| debian/systemd-cron(Debian:12) | < 1.5.17-2 | 1.5.17-2 |
| debian/systemd-cron(Debian:13) | < 1.5.17-2 | 1.5.17-2 |
| debian/systemd-cron(Debian:14) | < 1.5.17-2 | 1.5.17-2 |
| cron project cron | <= 3.0pl1-128. | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-9525 vendor-advisory
- bugs.debian.org issue-tracking third-party-advisory vendor-advisory
- www.openwall.com mailing-list third-party-advisory
- 1038651 third-party-advisory vdb-entry
- [debian-lts-announce] 20190321 [SECURITY] [DLA 1723-1] cron security update mailing-list third-party-advisory
- [debian-lts-announce] 20211030 [SECURITY] [DLA 2801-1] cron security update mailing-list third-party-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking