The code was written during SIA analysis of this vulnerability. Vulnerable found is Paul Vixie Vixie Cron 3.0pl1. Local users can cause Vixie crontab to fail to drop privileges when editing files. Can lead to full system compromise.
Local users can manipulate crontab's lowering of privileges, leading to full system compromise.
Vixie cron is an implementation of the popular UNIX program that runs user-specified programs at periodic scheduled times. A serialization error exists in some versions of the crontab file maintenance program. The vulnerability was introduced in versions which were patched for seperate vulnerability in fall of 2000. When a parsing error occurs after a modification operation, crontab will fail to drop privileges correctly for subsequent modification operations. Because the program is installed setuid root, it may be possible for a local user to gain root privileges.