[linux-security] cron vulnerability

Synopsis
========
Cron package may allow local root exploit

Problem Description
===================
The cron package (vixie cron) that is shipped with most Linux distributions
allows a local root exploit, if the permissions on /var/spool/cron are set
insecurely.

Affected Systems
================
Debian

AFAIK no other distributions are affected, however, you should check this
yourself: type "ls -ld /var/spool/cron". The response should look like

drwx------    2 root     root         4096 Oct 10 14:26 /var/spool/cron

If it doesn't, your system is vulnerable.

Workaround
==========
chmod 700 /var/spool/cron

Solution
========
Debian 2.2 (potato)
upgrade to cron_3.0pl1-57.1_i386.deb

Debian Unstable (woody)
upgrade to cron_3.0pl1-61_i386.deb