Author: JT Smith
From Net-security.org: “Steven van Acker reported on bugtraq that the version of cfingerd
(aconfigurable finger daemon) as distributed in Debian GNU/Linux 2.2suffers from two problems:1.
The code that reads configuration files (files in which $ commands are expanded) copied its input
to a buffer without checking for a buffer overflow. When the ALLOW_LINE_PARSING feature is enabled
that code is used for reading users files as well, so local users could exploit this.2. There also
was a printf call in the same routine that did not protect against printf format attacks.Since
ALLOW_LINE_PARSING is enabled in the default /etc/cfingerd.conflocal users could use this to gain
root access.This has been fixed in version 1.4.1-1.2, and we recommend that you upgradeyour
cfingerd package immediately.”
(aconfigurable finger daemon) as distributed in Debian GNU/Linux 2.2suffers from two problems:1.
The code that reads configuration files (files in which $ commands are expanded) copied its input
to a buffer without checking for a buffer overflow. When the ALLOW_LINE_PARSING feature is enabled
that code is used for reading users files as well, so local users could exploit this.2. There also
was a printf call in the same routine that did not protect against printf format attacks.Since
ALLOW_LINE_PARSING is enabled in the default /etc/cfingerd.conflocal users could use this to gain
root access.This has been fixed in version 1.4.1-1.2, and we recommend that you upgradeyour
cfingerd package immediately.”
Category:
- Linux
