Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
do_command.c in Vixie cron (vixie-cron) 4.1 does not check the return code of a setuid call, which might allow local users to gain root privileges if setuid fails in cases such as PAM failures or resource limits, as originally demonstrated by a program that exceeds the process limits as defined in /etc/security/limits.conf.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Vixie Cron PAM_Limits 本地权限提升漏洞
Vulnerability Description
Vixie cron是Paul Vixie写的一种定时执行后台守护进程，许多免费Unix操作系统附带了该软件。 Vixie cron对进程权限的处理上存在漏洞，本地攻击者可能利用此漏洞获取root用户权限。 如果在limits.conf中将硬nproc限制设置为10并在/etc/pam.d/crond标注掉"session required pam_limits.so"的话，则达到进程限制的时候新进程会以root用户的身份启动。
CVSS Information
N/A
Vulnerability Type
N/A