Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-977 | GEN003020 | SV-37388r1_rule | DCSL-1 | Medium |
Description |
---|
If cron programs are located in or subordinate to world-writable directories, they become vulnerable to removal and replacement by malicious users or system intruders. |
STIG | Date |
---|---|
Red Hat Enterprise Linux 5 Security Technical Implementation Guide | 2014-04-02 |
Check Text ( C-36074r1_chk ) |
---|
List all cronjobs on the system. Procedure: # ls /var/spool/cron # ls /etc/cron.d /etc/crontab /etc/cron.daily /etc/cron.hourly /etc/cron.monthly /etc/cron.weekly or # ls /etc/cron*|grep -v deny If cron jobs exist under any of the above directories, use the following command to search for programs executed by at: # more Perform a long listing of each directory containing program files found in the cron file to determine if the directory is world-writable. # ls -ld If cron executes programs in world-writable directories, this is a finding. |
Fix Text (F-31318r1_fix) |
---|
Remove the world-writable permission from the cron program directories identified. Procedure: # chmod o-w |