VulnerabilityModified
CVE-2011-1075
A race condition in this process may lead to an arbitrary MD5 comparison regardless of the read permissions.
LOW 3.7EPSS 0.76%
Does this matter?
Lower severity and a low EPSS score (0.76%). Track it; it rarely justifies an emergency change on its own.
Description
FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In particular, it uses the MD5File() function, which takes a pathname as an argument, and is called with euid 0. A race condition in this process may lead to an arbitrary MD5 comparison regardless of the read permissions.
- CVSS 3.1
- 3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.76% probability · 53th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-362
- Affected
- freebsd/freebsd
- Source
- secalert@redhat.com
References
- https://marc.info/?l=full-disclosure&m=129891323028897&w=2Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211125-0004/Third Party Advisory
- https://www.openwall.com/lists/oss-security/2011/02/28/14Mailing List, Third Party Advisory
- https://marc.info/?l=full-disclosure&m=129891323028897&w=2Third Party Advisory
- https://security.netapp.com/advisory/ntap-20211125-0004/Third Party Advisory
- https://www.openwall.com/lists/oss-security/2011/02/28/14Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.