Free DISA STIG and SRG Library | Vaulted

V-977

Cron must not execute programs in, or subordinate to, world-writable directories.

Finding ID
GEN003020
Rule ID
SV-38544r1_rule
Severity
Cat II
CCE
(None)
Group Title
GEN003020
CCI
CCI-000225
Target Key
(None)
Documentable
No
Discussion

If cron programs are located in or subordinate to world-writable directories, they become vulnerable to removal and replacement by malicious users or system intruders.

Fix Text

Remove the world-writable permission from the cron program directories identified. Procedure: # chmod o-w <cron program directory>

Check Content

List all cronjobs on the system. Procedure: # ls -lL /var/spool/cron/crontabs If cron jobs exist under any of the above directories, search for programs executed by cron: Procedure: # more <cron job file> Determine if the directory containing programs executed from cron is world-writable. Procedure: # ls -lLd <cron program directory> If cron executes programs in world-writable directories, this is a finding.

Responsibility

System Administrator

IA Controls

DCSL-1