Public bug reported: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
affects ubuntu/cron While scanning /etc/cron.d, cron prefixes an accepted filename with "*system*" in a fixed-size fname buffer using strcpy()/strcat(). A valid maximum-length directory entry can exceed the buffer and overwrite stack memory. Creating such a file normally requires control of root-owned /etc/cron.d. This is a hardening and reliability issue; no unprivileged control or privilege escalation was demonstrated. The fix uses checked snprintf() construction for the internal name and path, skipping an entry that cannot fit. Debian report with the issue-specific patch and boundary regression test: https://bugs.debian.org/1152900 The patched Ubuntu source passed a focused regression in a disposable container; the Debian patched source built and passed its existing integration suite. Ubuntu and Debian Security Teams recommended public bug reports. Please consider the fix for Ubuntu and supported-release backports as appropriate. Brett Sutton -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQT9urELYHGjhO/7gF+TZqY73ysXxAUCauk/FQAKCRCTZqY73ysX xOmlAP9Igl0QhANlVJVuWAWH9+EUX9PGzVNBleUaSB/KzDrLGAEAi0fxKsT6S9cj 1mmOOUOrWjCjKVWn5kYb+xoW3r9TlAs= =egOV -----END PGP SIGNATURE----- ** Affects: cron (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172795 Title: cron should bound /etc/cron.d filename construction To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cron/+bug/2172795/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
