Warning messages from stat printed on installation with no user crontabs

[Andrew Ruthven]

On installation of cron on a new system, or (I expect) an upgrade with no user crontab files the following is printed:

Setting up cron (3.0pl1-128.1ubuntu1.1) ...
stat: cannot stat '*': No such file or directory
stat: cannot stat '*': No such file or directory
stat: cannot stat '*': No such file or directory
Warning: * is not a regular file!

This is related to the fix for CVE-2017-9525 introduced in 3.0pl1-128.1ubuntu1.1. The for loop at line 66 of cron.postinst needs to have a guard like the following added to it:

[ "$tab_name" = "*" ] && continue

We have observed this with Bionic, I haven't checked any other Ubuntu releases.

Cheers,
Andrew

[Jeremy Chadwick (koitsu)]

I was just in the process of writing David Fernandez Gonzalez an Email about this problem when I came across this ticket.

I can confirm this problem on Ubuntu 18.04.6. My 20.x machines did not get the update, so I cannot verify on other releases:

Unpacking cron (3.0pl1-128.1ubuntu1.1) over (3.0pl1-128.1ubuntu1) ...
Setting up cron (3.0pl1-128.1ubuntu1.1) ...
stat: cannot stat '*': No such file or directory
stat: cannot stat '*': No such file or directory
stat: cannot stat '*': No such file or directory
Warning: * is not a regular file!

Every single sysadmin should be concerned. ANY TIME we see asterisk wildcards being used in this fashion, where [ or test operators are behaving in this manner, we have reason to become concerned. To me, this smells of a shell script trying to parse crontab entries, which is inherently dangerous.

I am now questioning whether or not this postinst script potentially nuked something it shouldn't have.

How this was missed is beyond me.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Mikko Rantalainen (mira)]

Confirming this on Ubuntu 18.04.6 LTS while installing updates:

Setting up cron (3.0pl1-128.1ubuntu1.1) ...
stat: cannot stat '*': No such file or directory
stat: cannot stat '*': No such file or directory
stat: cannot stat '*': No such file or directory
Warning: * is not a regular file!
update-rc.d: warning: start and stop actions are no longer supported; falling back to defaults

I'm pretty sure I haven't seen this problem with other updates.

[Launchpad Janitor (janitor)]

This bug was fixed in the package cron - 3.0pl1-128.1ubuntu1.2

---------------
cron (3.0pl1-128.1ubuntu1.2) bionic-security; urgency=medium

  * SECURITY REGRESSION: CVE-2017-9525 regression (LP: #1971895)
    - debian/postinst: add tab_name emptiness check
    - https://salsa.debian.org/debian/cron/-/commit/23047851

 -- Rodrigo Figueiredo Zaiden <email address hidden> Tue, 10 May 2022 17:59:19 -0300

[Rodrigo Figueiredo Zaiden (rodrigo-zaiden)]

This bug was fixed in the package cron - 3.0pl1-128ubuntu2+esm2

---------------
cron (3.0pl1-128ubuntu2+esm2) xenial-security; urgency=medium

  * SECURITY REGRESSION: CVE-2017-9525 regression (LP: #1971895)
    - debian/postinst: add tab_name emptiness check
    - https://salsa.debian.org/debian/cron/-/commit/23047851

 -- Rodrigo Figueiredo Zaiden <email address hidden> Tue, 10 May 2022 18:07:46 -0300

[Jeremy Chadwick (koitsu)]

I can confirm the issue in question is fixed on bionic/18.04.6 via cron 3.0pl1-128.1ubuntu1.2.