zkfingerd say() Format String Vulnerability

Bugtraq ID:	6404
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 16 2002 12:00AM
Updated:	Dec 16 2002 12:00AM
Credit:	Discovery of this vulnerability credited to "NGSSoftware Insight Security Research" <[email protected]>.
Vulnerable:	zkfingerd zkfingerd 0.9.1
Not Vulnerable:

zkfingerd say() Format String Vulnerability

zkfingerd is prone to a format string vulnerability. The affected function does not perform sufficient checks when displaying user-supplied input. It is possible to corrupt memory by passing format strings through the vulnerable function. This may potentially be exploited to overwrite arbitrary locations in memory with attacker-specified values.

Successful exploitation of this issue may allow the attacker to execute arbitrary instructions, possibly, with elevated privileges.

zkfingerd say() Format String Vulnerability

The following exploit was provided by Marceta Milos <[email protected]>:

• /data/vulnerabilities/exploits/johnx.c

zkfingerd say() Format String Vulnerability

Solution:
Fixes for this vulnerability are available via CVS at:

http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/zkfingerd/zkfingerd/src/

zkfingerd say() Format String Vulnerability

References:

• zkfingerd Home Page (zkfingerd)
  
• zkfingerd 0.9.1 format string vulnerabilities (#NISR16122002A) ("NGSSoftware Insight Security Research" )