Cron must not execute programs in, or subordinate to, world-writable directories.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-977	GEN003020	SV-45580r1_rule		Medium

Description
If cron programs are located in or subordinate to world-writable directories, they become vulnerable to removal and replacement by malicious users or system intruders.

STIG	Date
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide	2018-09-19

Details

Check Text ( C-42933r1_chk )
List all cronjobs on the system. Procedure: # ls /var/spool/cron /var/spool/cron/tabs # ls /etc/crontab /etc/cron.{d,daily,hourly,monthly,weekly} or # ls /etc/cron*\|grep -v deny If cron jobs exist under any of the above directories, use the following command to search for programs executed by at: # more Perform a long listing of each directory containing program files found in the cron file to determine if the directory is world-writable. # ls -ld If cron executes programs in world-writable directories, this is a finding.

Check Text ( C-42933r1_chk )

List all cronjobs on the system.
Procedure:

# ls /var/spool/cron /var/spool/cron/tabs

# ls /etc/crontab /etc/cron.{d,daily,hourly,monthly,weekly}
or
# ls /etc/cron*|grep -v deny

If cron jobs exist under any of the above directories, use the following command to search for programs executed by at:

# more

Perform a long listing of each directory containing program files found in the cron file to determine if the directory is world-writable.

# ls -ld

If cron executes programs in world-writable directories, this is a finding.

Fix Text (F-38977r1_fix)
Remove the world-writable permission from the cron program directories identified. Procedure: # chmod o-w