Privilege escalation in Cron - CVE-2017-9525

Vulnerability identifier: #VU7010

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-9525

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in Cron due to a flaw in the postinst maintainer script. A local attacker with crontab group privileges can conduct a symlink attack, bypass crontab privilege separation controls and gain root privileges on the target system.

Successful exploitation of the vulnerability results in privilege escalation.

Cron
Isolation Segment
VMware Tanzu Application Service for VMs
Debian Linux
Ubuntu
cflinuxfs3
Tanzu Greenplum for Kubernetes
VMware Tanzu Operations Manager
cron (Ubuntu package)

Cybersecurity Help is currently unaware of any official patch addressing the vulnerability.

Isolation Segment - addressed in versions 2.7.45, 2.10.25, 2.11.14, 2.12.8
VMware Tanzu Application Service for VMs - addressed in versions 2.7.50, 2.10.32, 2.11.20, 2.12.13
cflinuxfs3 - addressed in versions 0.294.0, 0.295.0
Tanzu Greenplum for Kubernetes - update to 2.0.0
VMware Tanzu Operations Manager - addressed in versions 2.9.39, 2.10.40
cron (Ubuntu package) - addressed in versions 3.0pl1-128.1ubuntu1.2, 3.0pl1128ubuntu2+esm1

• http://www.openwall.com/lists/oss-security/2017/06/08/3

• Privilege escalation in Debian
• Privilege escalation in Ubuntu
• Ubuntu update for cron
• Multiple vulnerabilities in cflinuxfs3
• Multiple vulnerabilities in cflinuxfs3
• Ubuntu update for cron
• VMware Tanzu products update for Cron
• VMware Tanzu products update for Cron