CVE-2011-1075

Name	CVE-2011-1075
Description	FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In particular, it uses the MD5File() function, which takes a pathname as an argument, and is called with euid 0. A race condition in this process may lead to an arbitrary MD5 comparison regardless of the read permissions.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cron (PTS)	jessie, jessie (lts)	3.0pl1-127+deb8u2	fixed
	stretch (security), stretch (lts), stretch	3.0pl1-128+deb9u2	fixed
	buster	3.0pl1-134+deb10u1	fixed
	bullseye	3.0pl1-137	fixed
	bookworm	3.0pl1-162	fixed
	sid, trixie	3.0pl1-189	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cron	source	(unstable)	(not affected)

- cron <not-affected> (Debian's cron not affected)