CVE-2017-9525

Name of the Vulnerable Software and Affected Versions cron versions 3.0pl1-128 through 3.0pl1-128ubuntu2

Description The issue is related to the cron package, where the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs. This can be exploited by an attacker to gain elevated privileges.

Recommendations For cron versions 3.0pl1-128 through 3.0pl1-128ubuntu2, consider disabling the postinst maintainer script as a temporary workaround to minimize the risk of exploitation. Restrict access to the chown and chmod programs to prevent unsafe usage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.