Bug 171393 – sys-process/fcron local DoS

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Wolfram Schlich (RETIRED) 2007-03-18 22:56:44 UTC]

I have just committed =sys-process/fcron-3.0.2-r1 that should fix
a local DoS issue that exists with older versions.

Previous versions used the user + group 'cron' provided by cronbase.
The fcrontabs directory /var/spool/fcrontabs was cron:cron and 0770
and every user that should be able to use fcron had to be member
of the group 'cron', thus being able to remove *all* crontabs stored
in the fcrontabs directory /var/spool/fcrontabs.

The changes in 3.0.2-r1 introduce a new user and group 'fcron'
that are now used for least-privilege operation of the fcron tools
instead of cron:cron, but don't require the users that should be able
to use fcron to be members of the group 'cron' or 'fcron' (the only
way to restrict access to the fcron* commands now is by adding users to
the files /etc/fcron/fcron.{allow,deny}).

Users that are still in members of the group 'cron' cannot do
anything bad after the upgrade.

Version 3.0.2 itself is in Portage since 2007-01-18, so
considering marking it stable might be reasonable.

UPDATE: I have just committed some small changes to 3.0.2-r1,
so please everyone be sure to get the latest version (1.2).

Thanks!

[Comment 1 Raphael Marichez (Falco) (RETIRED) 2007-03-19 00:16:03 UTC]

Disclosing this issue with Wolfram's aggrement

CCing arches.

Arches, please test and mark stable sys-process/fcron-3.0.2-r1 if appropriate, thanks.

[Comment 2 Christian Faulhammer (RETIRED) 2007-03-19 07:24:04 UTC]

x86 stable

[Comment 3 Wolfram Schlich (RETIRED) 2007-03-19 09:30:57 UTC]

dear arches, please STOP stabilizing as I have missed something in
the upgrade path.

the permissions of /etc/fcron and /etc/fcrontab don't get fixed,
I have to add another chown+chmod combo to the build.

@x86, what do we do? 3.0.2-r1 is already marked stable on your arch.

[Comment 4 Wolfram Schlich (RETIRED) 2007-03-19 10:09:23 UTC]

Talked to armin76 on IRC -- I will just commit the fixed ebuild.

[Comment 5 Wolfram Schlich (RETIRED) 2007-03-19 10:20:59 UTC]

Committed fixed fcron-3.0.2-r1.ebuild (revision 1.4).

[Comment 6 Gustavo Zacarias (RETIRED) 2007-03-19 13:54:05 UTC]

Hmmm it lacks a virtual/mta dep and wants /usr/sbin/sendmail...

[Comment 7 Gustavo Zacarias (RETIRED) 2007-03-19 13:54:52 UTC]

Also x86 lost it's stable keyword in the fix0r or whatnot...

[Comment 8 Wolfram Schlich (RETIRED) 2007-03-19 14:53:02 UTC]

(In reply to comment #6)
> Hmmm it lacks a virtual/mta dep and wants /usr/sbin/sendmail...

Added virtual/mta to DEPEND. Thanks!

(In reply to comment #7)
> Also x86 lost it's stable keyword in the fix0r or whatnot...

ARGH! :( I thought I had taken care of it... sorry :(
Anyway, armin76 fixed it... thanks!

[Comment 9 Gustavo Zacarias (RETIRED) 2007-03-19 14:56:18 UTC]

sparc stable then, thanks!

[Comment 10 Christian Faulhammer (RETIRED) 2007-03-19 15:09:54 UTC]

Hey, now, we really want to leave...x86 gone again from this bug.

[Comment 11 Jeroen Roovers (RETIRED) 2007-03-20 03:07:04 UTC]

Stable for HPPA.

[Comment 12 Tobias Scherbaum (RETIRED) 2007-03-20 20:27:34 UTC]

ppc stable

[Comment 13 Steve Dibb (RETIRED) 2007-03-22 02:08:15 UTC]

amd64 stable

[Comment 14 Wolfram Schlich (RETIRED) 2007-03-23 23:31:17 UTC]

*** Bug 131381 has been marked as a duplicate of this bug. ***

[Comment 15 Matt Drew (RETIRED) 2007-03-24 22:39:15 UTC]

security, please vote - I vote no GLSA, local DoS, low impact.

[Comment 16 Vic Fryzel (shellsage) (RETIRED) 2007-03-25 03:17:11 UTC]

I vote no, this seems low impact.

[Comment 17 Sune Kloppenborg Jeppesen (RETIRED) 2007-03-25 05:55:01 UTC]

Two NO votes -> Closing with NO GLSA. Feel free to reopen if you disagree.