From owner-freebsd-security Mon Oct 30 1:42:43 2000 Delivered-To: freebsd-security@freebsd.org Received: from citusc17.usc.edu (citusc17.usc.edu [128.125.38.177]) by hub.freebsd.org (Postfix) with ESMTP id 044DC37B4C5 for ; Mon, 30 Oct 2000 01:42:40 -0800 (PST) Received: (from kris@localhost) by citusc17.usc.edu (8.11.1/8.11.1) id e9U9ieC11937; Mon, 30 Oct 2000 01:44:40 -0800 (PST) (envelope-from kris) Date: Mon, 30 Oct 2000 01:44:40 -0800 From: Kris Kennaway To: Matt Heckaman Cc: FreeBSD-SECURITY Subject: Re: crontab problem Message-ID: <20001030014440.A11913@citusc17.usc.edu> References: Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="LQksG6bCIzRHxTLp" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: ; from matt@ARPA.MAIL.NET on Mon, Oct 30, 2000 at 01:10:15AM -0500 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org --LQksG6bCIzRHxTLp Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Oct 30, 2000 at 01:10:15AM -0500, Matt Heckaman wrote: > Hi all, >=20 > Does anyone have a patch for the crontab problem describe on bugtraq? I > need to get it fixed and can't afford a make world. A patch or the pair > of revision numbers would be great, thanks. :) There was a patch posted to -audit a few days ago which is yet unreviewed but claims to address the issue. Note that we've been unable to replicate the claimed full impact of the problem on FreeBSD - the impact seems to be limited to reading files which are a valid cron job syntax, meaning basically files which are entirely commented out, or actual cron jobs (e.g. those owned by other users). Still a problem, though. Kris --LQksG6bCIzRHxTLp Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjn9QwcACgkQWry0BWjoQKV7OQCg0r7zKT84Zitsh8D68j+2IfPI omsAoPvGAAYJWyg1tKiAlvvk8yCzx/aj =cOv6 -----END PGP SIGNATURE----- --LQksG6bCIzRHxTLp-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message