zkfingerd SysLog Format String Vulnerability

Bugtraq ID:	6402
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 16 2002 12:00AM
Updated:	Dec 16 2002 12:00AM
Credit:	Discovery of this vulnerability credited to "NGSSoftware Insight Security Research" <[email protected]>.
Vulnerable:	zkfingerd zkfingerd 0.9.1
Not Vulnerable:

zkfingerd SysLog Format String Vulnerability

zkfingerd is prone to a format string vulnerability. This problem is due to incorrect use of the 'syslog()' function to log error messages. It is possible to corrupt memory by passing format strings through the vulnerable logging function. This may potentially be exploited to overwrite arbitrary locations in memory with attacker-specified values.

Successful exploitation of this issue may allow the attacker to execute arbitrary instructions, possibly, with elevated privileges.

zkfingerd SysLog Format String Vulnerability

The following exploit was provided by Marceta Milos <[email protected]>:

• /data/vulnerabilities/exploits/johnx.c

zkfingerd SysLog Format String Vulnerability

Solution:
Fixes for this vulnerability are available via CVS at:

http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/zkfingerd/zkfingerd/src/

zkfingerd SysLog Format String Vulnerability

References:

• zkfingerd Home Page (zkfingerd)
  
• zkfingerd 0.9.1 format string vulnerabilities (#NISR16122002A) ("NGSSoftware Insight Security Research" )