There is, in fact, a patch for this vulnerability: It's attached to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=864466
If any Ubuntu user wants to apply the patch to 16.04 or 18.04, test it, and then report back to the Ubuntu Security Team on their testing, your real contribution to Ubuntu will be welcome.
For folks who don't want to apply patches themselves, nor upgrade to a non-vulnerable release, The Ubuntu Security Team has triaged this, and thinks that it's a Low priority bug for several good reasons.
Looks like the vulnerability can only be triggered when cron is upgraded by apt by an attacker that is already a member of the crontab group (usually nobody is).
- Information: The
cron package received NO post-release updates in 14.04, 16.04 so far, nor 18.04 so far. This vulnerability has a very, very limited window of opportunity - once every 6 months (or once every two years).
This means that you have several possible ways to lower your risk while some other community members test and backport the patch:
Here's an example:
apt-mark hold cron, so it does not update unobserved. The vulnerability is part of the postinstall script, which only runs when the
cron package updates (or if you reinstall cron for whatever reason).
In a default install of Ubuntu, nobody is in the
crontab group. You can check /etc/groups for any unexpected members of the
crontab group, and remove them, before releasing the apt-hold and updating cron.
The exploit involves using dangling symlinks to fool the kernel. You can check for dangling symlinks in $crondir/crontabs before upgrading cron. Again, easy to spot using plain old
ls -la, and takes only a moment to remove.
It's also important to point out to newer users that an intruder or malware that has gained access to the crontab group has already compromised your system, regardless of whether they gain root or not.