cfingerd Buffer Oveflow Vulnerability
BID:512
Info
cfingerd Buffer Oveflow Vulnerability
| Bugtraq ID: | 512 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 02 1999 12:00AM |
| Updated: | Jul 02 1999 12:00AM |
| Credit: | First posted to BugTraq by Salvatore Sanfilippo -antirez- <[email protected]> on July 2, 1999. |
| Vulnerable: |
Debian Linux 2.0 r5 Debian Linux 2.0 Debian Linux 1.3.1 Debian Linux 1.3 Debian Linux 1.2 |
| Not Vulnerable: |
Debian Linux 2.1 |
Discussion
cfingerd Buffer Oveflow Vulnerability
There is a remotely exploitable buffer overflow in cfingerd 1.3.2, which ships with Debian GNU/Linux. The offending code is as follows:
int search_fake(char *username)
{
char parsed[80];
bzero(parsed, 80);
sscanf(username, "%[^.].%*[^\r\n]\r\n", parsed);
...
called from process_username(), that is called from main:
int main(int argc, char *argv[])
{
char username[100], syslog_str[200];
...
if (!emulated) {
if (!fgets(username, sizeof(username), stdin)) {
...
/* Check the finger information coming in and return its type */
un_type = process_username(username);
search_illegal() is called before search_fake(), so only legal characters [A-z0-9] can be used to exploit this vulnerability. The consequence is a remote root compromise.
There is a remotely exploitable buffer overflow in cfingerd 1.3.2, which ships with Debian GNU/Linux. The offending code is as follows:
int search_fake(char *username)
{
char parsed[80];
bzero(parsed, 80);
sscanf(username, "%[^.].%*[^\r\n]\r\n", parsed);
...
called from process_username(), that is called from main:
int main(int argc, char *argv[])
{
char username[100], syslog_str[200];
...
if (!emulated) {
if (!fgets(username, sizeof(username), stdin)) {
...
/* Check the finger information coming in and return its type */
un_type = process_username(username);
search_illegal() is called before search_fake(), so only legal characters [A-z0-9] can be used to exploit this vulnerability. The consequence is a remote root compromise.
Exploit / POC
cfingerd Buffer Oveflow Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
cfingerd Buffer Oveflow Vulnerability
Solution:
Debian 2.1, which ships with cfingerd 1.3.2-18 is known to be patched.
The following patch was offered by Larry W. Cashdollar in his BugTraq posting on July 2, 1999:
(cut the diff, use patch to apply to parse.c)
From Larry's post:
[root@dt065n87 src]# diff parse.old parse.c
78c78
< char parsed[80];
---
> char parsed[100];
80c80
< bzero(parsed, 80);
---
> bzero(parsed, 100);
Solution:
Debian 2.1, which ships with cfingerd 1.3.2-18 is known to be patched.
The following patch was offered by Larry W. Cashdollar in his BugTraq posting on July 2, 1999:
(cut the diff, use patch to apply to parse.c)
From Larry's post:
[root@dt065n87 src]# diff parse.old parse.c
78c78
< char parsed[80];
---
> char parsed[100];
80c80
< bzero(parsed, 80);
---
> bzero(parsed, 100);
References
cfingerd Buffer Oveflow Vulnerability
References:
References:
- Debian cfingerd Package Reference (Debian GNU/Linux)