9

The vulnerability CVE-2017-9525 exist in cron package in Ubnuntu Bionic,

https://people.canonical.com/~ubuntu-security/cve/pkg/cron.html

We want to fix it in our server, however there are no patches available for this specific version of Cron. The latest cron version for this distribution is 3.0pl1-128.1ubuntu1, which is reported to be vulnerable to CVE-2017-9525 as shown here: https://packages.ubuntu.com/bionic/cron

In order to be compliant. we need to fix this vulnerability. We have already tried downloading deb packages for cron from latest Ubuntu distribution, and installing them but those are not supported by Ubuntu 18 unfortunately.

Is there any way to upgrade cron in Ubuntu 18 and fix this vulnerability?

  • I understand what you're saying, but it's still 3 years old and fixed in the v20.04 release of Ubuntu. – ajgringo619 Sep 26 at 2:59
  • @ajgringo619 addressed your point in the answer. – user535733 Sep 26 at 3:23
12

There is, in fact, a patch for this vulnerability: It's attached to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=864466

If any Ubuntu user wants to apply the patch to 16.04 or 18.04, test it, and then report back to the Ubuntu Security Team on their testing, your real contribution to Ubuntu will be welcome.


For folks who don't want to apply patches themselves, nor upgrade to a non-vulnerable release, The Ubuntu Security Team has triaged this, and thinks that it's a Low priority bug for several good reasons.

Looks like the vulnerability can only be triggered when cron is upgraded by apt by an attacker that is already a member of the crontab group (usually nobody is).

  • Information: The cron package received NO post-release updates in 14.04, 16.04 so far, nor 18.04 so far. This vulnerability has a very, very limited window of opportunity - once every 6 months (or once every two years).

This means that you have several possible ways to lower your risk while some other community members test and backport the patch:

Here's an example:

  1. You can apt-mark hold cron, so it does not update unobserved. The vulnerability is part of the postinstall script, which only runs when the cron package updates (or if you reinstall cron for whatever reason).

  2. In a default install of Ubuntu, nobody is in the crontab group. You can check /etc/groups for any unexpected members of the crontab group, and remove them, before releasing the apt-hold and updating cron.

  3. The exploit involves using dangling symlinks to fool the kernel. You can check for dangling symlinks in $crondir/crontabs before upgrading cron. Again, easy to spot using plain old ls -la, and takes only a moment to remove.

It's also important to point out to newer users that an intruder or malware that has gained access to the crontab group has already compromised your system, regardless of whether they gain root or not.

| improve this answer | |
  • Thank you. Is there a process to apply this patch? I can see a file attached with the changes. Do I need to build cron myself to apply the patch or if there is a patched deb file – foo_paul Sep 26 at 3:54
  • I have found it launchpad.net/debian/+source/cron/3.0pl1-129 – foo_paul Sep 26 at 3:59
  • I have downloaded code and tried building it using make. Not working, cron.c:215:24: error: dereferencing pointer to incomplete type ‘struct tm’ TargetTime += (60 - tm->tm_sec); ^~ – foo_paul Sep 26 at 4:03
  • Do not compile code. The vulnerability has nothing to do with cron's C source code. The vulnerability is in the postinstall script...as both the patch and the CVE clearly state. Here's how: 1. Locate the postinstall script. 2. Download the patch (it's a text file). 3. Use the "patch" application to install the patch: sudo patch /path/to/postinstall_script /path/to/patch_file. Fin. – user535733 Sep 26 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.