File vixie-cron-4.1-race-mtime.patch of Package cron
--- vixie-cron-4.1/crontab.c.CVE-2010-0424 2010-02-18 04:51:54.000000000 -0500
+++ vixie-cron-4.1/crontab.c 2010-02-18 04:56:32.000000000 -0500
@@ -378,8 +378,6 @@ edit_cmd(void) {
perror("fstat");
goto fatal;
}
- utimebuf.actime = statbuf.st_atime;
- utimebuf.modtime = statbuf.st_mtime;
/* Turn off signals. */
(void)signal(SIGHUP, SIG_IGN);
@@ -463,7 +461,17 @@ edit_cmd(void) {
perror(Filename);
exit(ERROR_EXIT);
}
+ if (swap_uids() < OK) {
+ perror("swapping uids");
+ exit(ERROR_EXIT);
+ }
+ utimebuf.actime = statbuf.st_atime;
+ utimebuf.modtime = statbuf.st_mtime;
utime(Filename, &utimebuf);
+ if (swap_uids_back() < OK) {
+ perror("swapping uids back");
+ exit(ERROR_EXIT);
+ }
again:
rewind(NewCrontab);
if (ferror(NewCrontab)) {