Re: vixie cron possible local root compromise

[Peter van Dijk]

On Sun, Feb 11, 2001 at 12:38:02AM +0100, Flatline wrote:
[snip]
> - Quick fix (diff output for crontab.c):
>
> 146c146
> <       strcpy(User, pw->pw_name);
> ---
>  >       strncpy(User, pw->pw_name, MAX_UNAME - 1);

Uhm, won't the user running crontab then get another user's crontab,
if the 'stripped' username actually exists?

Greetz, Peter.