crontab(1) silently truncates file path arguments >=100 chars
A Debian bug report says crontab truncates file paths of 100 or more characters, risking the wrong crontab.
Vincent Lefevre told the oss-security list about Debian bug 1144850, a minor cron issue in which crontab(1) truncates file-path arguments of 100 characters or more. He suspects the bug report's reproduction steps miscount the total characters. He adds that truncation is not silent unless the named file exists, in which case crontab affects a different file. No CVE is mentioned.
- Debian bug 1144850 concerns crontab path truncation at 100 characters.
- Lefevre says the report's character count looks incorrect.
- An existing truncated path can select a different crontab file.
- The oss-security post lists no CVE.
Posted by Vincent Lefevre on Sep 28 A "minor" bug in cron was reported in the Debian BTS: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144850 "cron: crontab(1) silently truncates file path arguments >=100 chars" I suspect that there is a typo in the given instructions there because the total number of characters is incorrect. Moreover, the truncation is not silent, unless the file exists, in which case it leads to a different crontab file being...
This source does not provide full text. Read it at seclists.org.