Security bug allows to edit other users crontab root# pw useradd -n www.promspecbud.com -g nobody -s /bin/sh -d /tmp root# pw useradd -n www.promspecbud.com.other -g nobody -s /bin/sh -d /tmp root# echo @daily doit baby > /tmp/test root# crontab -u www.promspecbud.com.other /tmp/test root# crontab -u www.promspecbud.com -l =====output ===== @daily doit baby ================= root#echo @daily doit baby one more time>> /tmp/test root#sudo -u www.promspecbud.com.other crontab /tmp/test root#sudo -u www.promspecbud.com crontab -l =====output ===== @daily doit baby @daily doit baby one more time ================= root# uname -a FreeBSD kuzik 10.3-RELEASE FreeBSD 10.3-RELEASE #0 r297264: Fri Mar 25 02:10:02 UTC 2016 root@releng1.nyi.freebsd.org:/usr/obj/usr/src/sys/GENERIC amd64
Ouch. strncmp was probably used incorrectly :/..
A commit references this bug: Author: emaste Date: Fri Sep 2 03:15:54 UTC 2016 New revision: 305269 URL: https://svnweb.freebsd.org/changeset/base/305269 Log: cron: use existing maximum username constant MAXLOGNAME Previously cron had its own maximum username length limit, which was smaller than the system's MAXLOGNAME. This could lead to crontab -u updating the wrong user's crontab (if the name was truncated, and matched another user). PR: 212305 Reported by: Andrii Kuzik Reviewed by: allanjude, jilles MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D7747 Changes: head/usr.sbin/cron/cron/cron.h head/usr.sbin/cron/crontab/crontab.c
A commit references this bug: Author: emaste Date: Mon Sep 5 15:43:22 UTC 2016 New revision: 305423 URL: https://svnweb.freebsd.org/changeset/base/305423 Log: MFC r305269: cron: use existing maximum username constant MAXLOGNAME Previously cron had its own maximum username length limit, which was smaller than the system's MAXLOGNAME. This could lead to crontab -u updating the wrong user's crontab (if the name was truncated, and matched another user). PR: 212305 Reported by: Andrii Kuzik Changes: stable/11/usr.sbin/cron/cron/cron.h stable/11/usr.sbin/cron/crontab/crontab.c
A commit references this bug: Author: emaste Date: Mon Sep 5 15:50:40 UTC 2016 New revision: 305424 URL: https://svnweb.freebsd.org/changeset/base/305424 Log: MFC r305269: cron: use existing maximum username constant MAXLOGNAME Previously cron had its own maximum username length limit, which was smaller than the system's MAXLOGNAME. This could lead to crontab -u updating the wrong user's crontab (if the name was truncated, and matched another user). PR: 212305 Reported by: Andrii Kuzik Changes: _U stable/10/ stable/10/usr.sbin/cron/cron/cron.h stable/10/usr.sbin/cron/crontab/crontab.c
A commit references this bug: Author: emaste Date: Mon Sep 5 16:43:58 UTC 2016 New revision: 305427 URL: https://svnweb.freebsd.org/changeset/base/305427 Log: MFS r305423: cron: use existing maximum username constant MAXLOGNAME Previously cron had its own maximum username length limit, which was smaller than the system's MAXLOGNAME. This could lead to crontab -u updating the wrong user's crontab (if the name was truncated, and matched another user). PR: 212305 Reported by: Andrii Kuzik Approved by: re (kib) MFH: r305269 Changes: _U releng/11.0/ releng/11.0/usr.sbin/cron/cron/cron.h releng/11.0/usr.sbin/cron/crontab/crontab.c
A commit references this bug: Author: emaste Date: Mon Sep 5 17:56:53 UTC 2016 New revision: 305429 URL: https://svnweb.freebsd.org/changeset/base/305429 Log: MFC r305269: cron: use existing maximum username constant MAXLOGNAME Previously cron had its own maximum username length limit, which was smaller than the system's MAXLOGNAME. This could lead to crontab -u updating the wrong user's crontab (if the name was truncated, and matched another user). PR: 212305 Reported by: Andrii Kuzik Changes: _U stable/9/usr.sbin/cron/ stable/9/usr.sbin/cron/cron/cron.h _U stable/9/usr.sbin/cron/crontab/ stable/9/usr.sbin/cron/crontab/crontab.c
*** Bug 203235 has been marked as a duplicate of this bug. ***