The final username in an administrator-created /etc/cron.deny is not
matched if that line has no terminating newline. For example, when the
file consists of the bytes "blocked" without a trailing LF, the user
"blocked" can still run crontab(1), assuming no cron.allow file takes
precedence. The administrator expects that username to be denied. This
is conditional on use of cron.deny and the missing final LF; it does
not grant higher OS privileges.

The in_file() reader removes the final character unconditionally as
though it were a newline. The attached Debian -212 patch reads
complete physical records, matches a final unterminated line, handles
CRLF, and rejects overlong or NUL-containing records without consuming
a following valid entry. Its regression test covers those cases.

The patched Debian source built in a disposable trixie container; the
focused regression and all 13 existing Debian integration tests
passed. Ubuntu versions 3.0pl1-200ubuntu1 and -209ubuntu1 have the
same issue. Debian and Ubuntu Security Teams advised public bug
reports for these findings.

Regards,
Brett Sutton