Nessus Plugin #14903

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

[DSA066] DSA-066-1 cfingerd

Family:

Debian Local Security Checks

Category:

infos

Copyright:

This script is (C) 2004 Michel Arboi

Summary:

DSA-066-1 cfingerd

Version:

$Revision: 1.4 $

Cve_id:

CAN-2001-0735

Bugtraq_id:

2914, 2915

Xrefs:

DSA:066

Description:

Steven van Acker reported on bugtraq that the version of cfingerd (a
configurable finger daemon) as distributed in Debian GNU/Linux 2.2
suffers from two problems:


The code that reads configuration files (files in which $ commands are
expanded) copied its input to a buffer without checking for a buffer
overflow. When the ALLOW_LINE_PARSING feature is enabled that code
is used for reading users' files as well, so local users could exploit
this.

There also was a printf call in the same routine that did not protect
against printf format attacks.


Since ALLOW_LINE_PARSING is enabled in the default /etc/cfingerd.conf
local users could use this to gain root access.

This has been fixed in version 1.4.1-1.2, and we recommend that you upgrade
your cfingerd package immediately.



Solution : http://www.debian.org/security/2001/dsa-066
Risk factor : High