[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170608224258.11820.2FC34D65@matica.foolinux.mooo.com>
Date: Thu, 8 Jun 2017 15:44:41 -0700
From: Ian Zimmerman <itz@...mate.net>
To: oss-security@...ts.openwall.com
Subject: Re: Vixie/ISC Cron group crontab to root escalation
On 2017-06-08 20:05, Solar Designer wrote:
> Gentoo has a wiki page describing their Vixie Cron here:
>
> https://wiki.gentoo.org/wiki/Cron#vixie-cron
>
> Per their description, it's based on 4.1 and has some Linux specifics
> added (SELinux, PAM, etc.) I don't know whether they use group
> crontab.
Yes:
~$ ls -l /usr/bin/crontab
-rwxr-sr-x 1 root crontab 44336 Oct 12 2016 /usr/bin/crontab
--
Please *no* private Cc: on mailing lists and newsgroups
Personal signed mail: please _encrypt_ and sign
Don't clear-text sign:
http://primate.net/~itz/blog/the-problem-with-gpg-signatures.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
