Ffingerd Username Validity Disclosure Vulnerability
BID:1841
Info
Ffingerd Username Validity Disclosure Vulnerability
| Bugtraq ID: | 1841 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Apr 23 1999 12:00AM |
| Updated: | Apr 23 1999 12:00AM |
| Credit: | This vulnerability was reported to bugtraq by Eilon Gishri <[email protected]> on Fri, Apr 23, 1999. |
| Vulnerable: |
GNU Ffingerd 1.19 |
| Not Vulnerable: | |
Discussion
Ffingerd Username Validity Disclosure Vulnerability
A vulnerability in Ffingerd version 1.19, the popular remote user-information server, which allows a remote user to determine whether or not a given username exists on the system.
Normally, if a user has declined to be open to finger requests, a finger attempt will elicit this response:
'That user does not want to be fingered'
However, if a remote user attempts to finger a nonexistent username, the attempt will return the default message:
'That user does not want to be fingered.'
The extra '.' at the end of the second message reveals that the message was generated as a result of an attempt to finger a nonexistent user, as opposed to one who simply does not wish to be fingered. As a result, an attacker familiar with the discrepancy between the two failure message strings will be able to test the validity of usernames. Having this information can assist an attacker in carrying other compromises of system security.
A vulnerability in Ffingerd version 1.19, the popular remote user-information server, which allows a remote user to determine whether or not a given username exists on the system.
Normally, if a user has declined to be open to finger requests, a finger attempt will elicit this response:
'That user does not want to be fingered'
However, if a remote user attempts to finger a nonexistent username, the attempt will return the default message:
'That user does not want to be fingered.'
The extra '.' at the end of the second message reveals that the message was generated as a result of an attempt to finger a nonexistent user, as opposed to one who simply does not wish to be fingered. As a result, an attacker familiar with the discrepancy between the two failure message strings will be able to test the validity of usernames. Having this information can assist an attacker in carrying other compromises of system security.
Solution / Fix
Ffingerd Username Validity Disclosure Vulnerability
Solution:
--- ffingerd.c.old Thu Feb 18 12:50:36 1999
+++ ffingerd.c Fri Apr 23 18:48:54 1999
@@ -134,7 +134,7 @@
setgid(pwd->pw_gid);
setuid(pwd->pw_uid);
sprintf(filename,"%.200s/.nofinger",pwd->pw_dir);
- if (lstat(filename,&stat_buf)) {
+ if((lstat(filename,&stat_buf) == -1) && (errno == ENOENT)) {
#ifndef NO_SYSLOG
#ifdef FASCIST_LOGGING
char message[512];
@@ -154,7 +154,7 @@
dump_file(filename,"Public key:","No public key.");
} else {
char message[512];
- puts("That user does not want to be fingered");
+ puts("That user does not want to be fingered.");
#ifndef NO_SYSLOG
sprintf(message,"attempt to finger \"%.200s\" from %.200s\n",pwd->pw_name,remote);
syslog(LOG_FACILITY,"%s",message);
Solution:
--- ffingerd.c.old Thu Feb 18 12:50:36 1999
+++ ffingerd.c Fri Apr 23 18:48:54 1999
@@ -134,7 +134,7 @@
setgid(pwd->pw_gid);
setuid(pwd->pw_uid);
sprintf(filename,"%.200s/.nofinger",pwd->pw_dir);
- if (lstat(filename,&stat_buf)) {
+ if((lstat(filename,&stat_buf) == -1) && (errno == ENOENT)) {
#ifndef NO_SYSLOG
#ifdef FASCIST_LOGGING
char message[512];
@@ -154,7 +154,7 @@
dump_file(filename,"Public key:","No public key.");
} else {
char message[512];
- puts("That user does not want to be fingered");
+ puts("That user does not want to be fingered.");
#ifndef NO_SYSLOG
sprintf(message,"attempt to finger \"%.200s\" from %.200s\n",pwd->pw_name,remote);
syslog(LOG_FACILITY,"%s",message);
References
Ffingerd Username Validity Disclosure Vulnerability
References:
References: