CVE-1999-0768

Vulnerability

A buffer overflow vulnerability exists in Vixie Cron versions shipped with Red Hat Linux 4.2, 5.2, and 6.0, as well as S.u.S.E. Linux 6.0 and 6.1. The vulnerability is triggered by overflowing a buffer in the cron_popen() function when the MAILTO environment variable is utilized. This flaw affects the default setuid root installation of the Vixie cron daemon [1].

Exploitation

An attacker with local access can exploit this vulnerability by crafting a malicious crontab file. This file should set the MAILTO environment variable to a specially crafted string containing shellcode, and then schedule a command that will execute the shellcode. The exploit involves creating a CrOn file, waiting for cron to process it, and then potentially executing commands as root [1].

Impact

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with root privileges. Since the Vixie cron daemon is installed setuid root by default, this can lead to a full system compromise, granting the attacker complete control over the affected system [1].

Mitigation

This vulnerability affects specific older versions of Red Hat and S.u.S.E. Linux. It is recommended to upgrade to patched versions of the Vixie Cron daemon. Information on specific patched versions and release dates is not detailed in the provided references, but newer versions of Debian GNU/Linux are confirmed not to be vulnerable. No other workarounds are specified in the available references [1].