Vixie Cron is prone to a denial-of-service vulnerability.
Exploiting this issue allows local attackers to trigger a denial-of-service condition due to excessive memory consumption.
Vixie Cron prior to 3.0pl1-133 are vulnerable.
Information
Paul Vixie Vixie Cron 3.0pl1-131
Paul Vixie Vixie Cron 3.0pl1-130
Paul Vixie Vixie Cron 3.0pl1-128
Paul Vixie Vixie Cron 3.0pl1-127
Paul Vixie Vixie Cron 3.0pl1-126
Paul Vixie Vixie Cron 3.0pl1-125
Paul Vixie Vixie Cron 3.0pl1-124
Exploit
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
References:
- Vixie Cron Home Page (Paul Vixie)
- Bug 1687694 (CVE-2019-9705) - CVE-2019-9705 vixie-cron: dos(memory consumption) (Red Hat Bugzilla)
- Enforce maximum crontab line count of 1000 ()
- CVE-2019-9705 (Red Hat)