UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

Cron must not execute group-writable or world-writable programs.


Overview

Finding ID Version Rule ID IA Controls Severity
V-976 GEN003000 SV-45576r1_rule Medium
Description
If cron executes group-writable or world-writable programs, there is a possibility that unauthorized users could manipulate the programs with malicious intent. This could compromise system and network security.
STIG Date
SUSE Linux Enterprise Server v11 for System z 2016-12-20

Details

Check Text ( C-42929r1_chk )
List all cronjobs on the system.
Procedure:

# ls /var/spool/cron /var/spool/cron/tabs

# ls /etc/crontab /etc/cron.{d,daily,hourly,monthly,weekly}
or
# ls /etc/cron*|grep -v deny

If cron jobs exist under any of the above directories, use the following command to search for programs executed by cron:

# more

Perform a long listing of each program file found in the cron file to determine if the file is group-writable or world-writable.

# ls -la

If cron executes group-writable or world-writable files, this is a finding.
Fix Text (F-38973r1_fix)
Remove the world-writable and group-writable permissions from the cron program file(s) identified.
# chmod go-w