V-977

Discussion

If cron programs are located in or subordinate to world-writable directories, they become vulnerable to removal and replacement by malicious users or system intruders.

Check Content

List all cronjobs on the system. 
Procedure:

# ls /var/spool/cron /var/spool/cron/tabs


# ls /etc/crontab /etc/cron.{d,daily,hourly,monthly,weekly}
or 
# ls /etc/cron*|grep -v deny


If cron jobs exist under any of the above directories, use the following command to search for programs executed by at:

# more <cron job file>

Perform a long listing of each directory containing program files found in the cron file to determine if the directory is world-writable.

# ls -ld <cron program directory>

If cron executes programs in world-writable directories, this is a finding.