Description
crontab in Vixie cron 4.1, when running with the -e option, allows local users to read the cron files of other users by changing the file being edited to a symlink. NOTE: there is insufficient information to know whether this is a duplicate of CVE-2001-0235.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | vixie-cron | 4:4.1-36.EL4 | RHSA-2005:361 |
| RHEL 3 | vixie-cron | 4.1-10.EL3 | RHSA-2006:0117 |
Advisories 2
- RHSA-2006:0117 Red Hat Security Advisory: vixie-cron security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:361 Red Hat Security Advisory: vixie-cron security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2006:0117 vendor-advisory
- SUSE-SR:2007:007 vendor-advisory
- 24995 third-party-advisory
- oval:org.mitre.oval:def:11104 vdb-entry signature
- RHSA-2005:361 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-118.htm
- 19532 third-party-advisory
- 13024 vdb-entry
- 20666 third-party-advisory
- 20050406 crontab from vixie-cron allows read other users crontabs mailing-list