Title

Cron must not execute programs in, or subordinate to, world-writable directories. (Cat II impact)

Discussion

If cron programs are located in or subordinate to world-writable directories, they become vulnerable to removal and replacement by malicious users or system intruders.

Check Content

List all cronjobs on the system. Procedure: # ls /var/spool/cron /var/spool/cron/tabs # ls /etc/crontab /etc/cron.{d,daily,hourly,monthly,weekly} or # ls /etc/cron*|grep -v deny If cron jobs exist under any of the above directories, use the following command to search for programs executed by at: # more <cron job file> Perform a long listing of each directory containing program files found in the cron file to determine if the directory is world-writable. # ls -ld <cron program directory> If cron executes programs in world-writable directories, this is a finding.

Fix Text

Remove the world-writable permission from the cron program directories identified. Procedure: # chmod o-w <cron program directory>

Additional Identifiers

Rule ID: SV-45580r1_rule

Vulnerability ID: V-977

Group Title: GEN003020

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.