Debian Security Advisory
DSA-066-1 cfingerd -- remote exploit
- Date Reported:
- 11 Jul 2001
- Affected Packages:
- cfingerd
- Vulnerable:
- Yes
- Security database references:
- In the Bugtraq database (at SecurityFocus): BugTraq ID 2914, BugTraq ID 2915.
In Mitre's CVE dictionary: CVE-2001-0735. - More information:
-
Steven van Acker reported on bugtraq that the version of cfingerd (a
configurable finger daemon) as distributed in Debian GNU/Linux 2.2
suffers from two problems:
- The code that reads configuration files (files in which $ commands are expanded) copied its input to a buffer without checking for a buffer overflow. When the ALLOW_LINE_PARSING feature is enabled that code is used for reading users' files as well, so local users could exploit this.
- There also was a printf call in the same routine that did not protect against printf format attacks.
Since ALLOW_LINE_PARSING is enabled in the default /etc/cfingerd.conf local users could use this to gain root access.
This has been fixed in version 1.4.1-1.2, and we recommend that you upgrade your cfingerd package immediately.
- Fixed in:
-
Debian GNU/Linux 2.2 (potato)
- Source:
- http://security.debian.org/dists/stable/updates/main/source/cfingerd_1.4.1-1.2.diff.gz
- http://security.debian.org/dists/stable/updates/main/source/cfingerd_1.4.1-1.2.dsc
- http://security.debian.org/dists/stable/updates/main/source/cfingerd_1.4.1.orig.tar.gz
- http://security.debian.org/dists/stable/updates/main/source/cfingerd_1.4.1-1.2.dsc
- Alpha:
- http://security.debian.org/dists/stable/updates/main/binary-alpha/cfingerd_1.4.1-1.2_alpha.deb
- ARM:
- http://security.debian.org/dists/stable/updates/main/binary-arm/cfingerd_1.4.1-1.2_arm.deb
- Intel IA-32:
- http://security.debian.org/dists/stable/updates/main/binary-i386/cfingerd_1.4.1-1.2_i386.deb
- Motorola 680x0:
- http://security.debian.org/dists/stable/updates/main/binary-m68k/cfingerd_1.4.1-1.2_m68k.deb
- PowerPC:
- http://security.debian.org/dists/stable/updates/main/binary-powerpc/cfingerd_1.4.1-1.2_powerpc.deb
- Sun Sparc:
- http://security.debian.org/dists/stable/updates/main/binary-sparc/cfingerd_1.4.1-1.2_sparc.deb
MD5 checksums of the listed files are available in the original advisory.