CVE-2017-9525

En el paquete cron hasta la versión 3.0pl1-128 en Debian, y hasta la versión 3.0pl1-128ubuntu2 en Ubuntu, el script de mantenimiento postinst permite la escalada de privilegios de grupo-crontab a root por medio de ataques de enlace simbólico (symlink) contra el uso no seguro de los programas chown y chmod.

USN-5259-1 and USN-5259-2 fixed vulnerabilities in Cron. Unfortunately that update was incomplete and could introduce a regression. This update fixes the problem. It was discovered that the postinst maintainer script in Cron unsafely handled file permissions during package install or update operations. An attacker could possibly use this issue to perform a privilege escalation attack. Florian Weimer discovered that Cron incorrectly handled certain memory operations during crontab file creation. An attacker could possibly use this issue to cause a denial of service. It was discovered that Cron incorrectly handled user input during crontab file creation. An attacker could possibly use this issue to cause a denial of service. It was discovered that Cron contained a use-after-free vulnerability in its force_rescan_user function. An attacker could possibly use this issue to cause a denial of service.