Description
Vixie Cron before 4.1-r10 on Gentoo Linux is installed with insecure permissions, which allows local users to cause a denial of service (cron failure) by creating hard links, which results in a failed st_nlink check in database.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | vixie-cron | 4:4.1-70.el5 | RHSA-2007:0345 |
| RHEL 4 | vixie-cron | 4:4.1-47.EL4 | RHSA-2007:0345 |
| RHEL 3 | vixie-cron | 4.1-19.EL3 | RHSA-2007:0345 |
Advisories 1
- RHSA-2007:0345 Red Hat Security Advisory: vixie-cron security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player mailing-list
- 27886 third-party-advisory
- ADV-2007-3229 vdb-entry
- SUSE-SR:2007:007 vendor-advisory
- 1018081 vdb-entry
- 24995 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-261.htm
- GLSA-200704-11 vendor-advisory
- 25321 third-party-advisory
- oval:org.mitre.oval:def:11463 vdb-entry signature
- 25723 third-party-advisory
- MDKSA-2007:234 vendor-advisory
- 26909 third-party-advisory
- 23520 vdb-entry
- 27706 third-party-advisory
- RHSA-2007:0345 vendor-advisory
- 24905 third-party-advisory