Executive brief
A security vulnerability exists in a core system component used to schedule automated tasks on Unix-like operating systems. A local user with basic access to the system can exploit this flaw to gain full administrative control (root access). This could allow an attacker to view sensitive files, modify system configurations, or disrupt operations entirely.
Technical details
A buffer overflow vulnerability exists in the Vixie Cron library (up to version 3.0) due to improper bounds checking when handling environmental variables. A local, unprivileged attacker can exploit this by providing an excessively long environmental variable to the cron process. Because cron often runs with elevated privileges to execute scheduled tasks for various users, overflowing the buffer allows the attacker to overwrite memory and execute arbitrary code with root permissions. This is a classic local privilege escalation (LPE) vulnerability.
Affected products
- Vixie Cron library up to 3.0
Timeline
- 1996-12-12: disclosed