Debian Security Advisory

DSA-066-1 cfingerd -- remote exploit

Date Reported:
11 Jul 2001
Affected Packages:
Security database references:
In the Bugtraq database (at SecurityFocus): BugTraq ID 2914, BugTraq ID 2915.
In Mitre's CVE dictionary: CVE-2001-0735.
More information:
Steven van Acker reported on bugtraq that the version of cfingerd (a configurable finger daemon) as distributed in Debian GNU/Linux 2.2 suffers from two problems:
  1. The code that reads configuration files (files in which $ commands are expanded) copied its input to a buffer without checking for a buffer overflow. When the ALLOW_LINE_PARSING feature is enabled that code is used for reading users' files as well, so local users could exploit this.
  2. There also was a printf call in the same routine that did not protect against printf format attacks.

Since ALLOW_LINE_PARSING is enabled in the default /etc/cfingerd.conf local users could use this to gain root access.

This has been fixed in version 1.4.1-1.2, and we recommend that you upgrade your cfingerd package immediately.

Fixed in:

Debian GNU/Linux 2.2 (potato)

Intel IA-32:
Motorola 680x0:
Sun Sparc:

MD5 checksums of the listed files are available in the original advisory.