[Subject Prev][Subject Next][Thread Prev][Thread Next][Subject Index][Thread Index]

(fwd) PROGENY-SA-2001-06: Remote vulnerability in cfingerd



[Please upgrade if you use cfingerd.  Not distribution-specific --
Raju]

This is an RFC 1153 digest.
(1 message)
----------------------------------------------------------------------

Return-Path: <BUGTRAQ@xxxxxxxxxxxxxxxxx>
Approved-By: aleph1@xxxxxxxxxxxxxxxxx
Delivered-To: bugtraq@xxxxxxxxxxxxxxxxxxxxxxx
Message-ID:  <20010419205830.BB039140EB@xxxxxxxxxxxxxxxxxxxxxx>
Reply-To: Progeny Security Team <security@xxxxxxxxxxx>
X-To:         progeny-debian@xxxxxxxxxxxxxxxxx, linuxlist@xxxxxxxxxxxxxxxxxx
From: Progeny Security Team <security@xxxxxxxxxxx>
Sender: Bugtraq List <BUGTRAQ@xxxxxxxxxxxxxxxxx>
To: BUGTRAQ@xxxxxxxxxxxxxxxxx
Subject:      PROGENY-SA-2001-06: Remote vulnerability in cfingerd
Date:         Thu, 19 Apr 2001 15:58:30 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


 ---------------------------------------------------------------------------
 PROGENY LINUX SYSTEMS -- SECURITY ADVISORY               PROGENY-SA-2001-06
 ---------------------------------------------------------------------------

    Topic:          Remote vulnerability in cfingerd

    Category:       net
    Module:         cfingerd
    Announced:      2001-04-11
    Credits:        Megyer Laszlo <abulla@xxxxxxxxxxx>
    Affects:        Progeny Debian (cfingerd prior to 1.4.1-1.1)
                    Debian GNU/Linux (cfingerd prior to 1.4.1-1.1)
    Vendor-Status:  New Version Released (cfingerd_1.4.1-1.1)
    Corrected:      2001-04-19
    Progeny Only:   NO

    $Id: PROGENY-SA-2001-06,v 1.5 2001/04/19 20:53:30 jdaily Exp $

 ---------------------------------------------------------------------------


SYNOPSIS

The cfingerd package, a customizable finger daemon, contains a remote
root vulnerability in Progeny versions prior to 1.4.1-1.1.


PROBLEM DESCRIPTION

The bug exists in main.c where it passes input from an ident string to
the printf()-like format specifier in syslog().  It is possible to
overwrite things in the daemon's memory space and thus obtain root.


IMPACT

This bug could enable an attacker to obtain root access on a machine
connected to a network.


SOLUTION

Upgrade to a fixed version of cfingerd.  You may use Progeny's
cfingerd package version 1.4.1-1.1 or greater.


WORKAROUND

cfingerd is often not an essential tool for a system.  If desired, one
may remove it from a Progeny Debian system instead of upgrading.  This
command may be used to remove cfingerd:

  dpkg --remove cfingerd


UPDATING VIA APT-GET

 1. Ensure that your /etc/apt/sources.list file has a URI for Progeny's
    security update repository:

        deb http://archive.progeny.com/progeny updates/newton/

 2. Update your cache of available packages for apt(8).

    Example:

        # apt-get update

 3. Using apt(8), install the new ssh package.  apt(8) will download
    the update, verify it's integrity with md5, and then install the
    package on your system with dpkg(8).

    Example:

        # apt-get install cfingerd


UPDATING VIA DPKG

 1. Using your preferred FTP/HTTP client to retrieve the following
    updated files from Progeny's update archive at:

    http://archive.progeny.com/pub/progeny/updates/newton/

    Filename                             MD5 Checksum
    ------------------------------------ --------------------------------
    cfingerd_1.4.1-1.1_i386.deb          91115911a62b234a355c3c48053af98c

    Example:

        # wget http://archive.progeny.com/progeny/updates/newton/cfingerd_1.4.1-1.1_i386.deb

 2. Use the md5sum command on the retrieved file to verify that it matches
    the md5sum provided in this advisory:

    Example:

        # md5sum cfingerd_1.4.1-1.1_i386.deb

 3. Then install the replacement package(s) using the dpkg command.

    Example:

        # dpkg --install cfingerd_1.4.1-1.1_i386.deb


MORE INFORMATION

This bug was originally documented in a post to the BUGTRAQ mailing
list, available at http://www.securityfocus.com/archive/1/176087.

Progeny advisories can be found at http://www.progeny.com/security/.

 ---------------------------------------------------------------------------

pub  1024D/F92D4D1F 2001-04-04 Progeny Security Team <security@xxxxxxxxxxx>

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: For info see http://www.gnupg.org

mQGiBDrKpVkRBACS4/hjUliUt9UGTHMUGSZpQlKfBk9OFHmyLHTdjyIBCWRMmOBn
RRhag0FgPicVIDndoQvYw3+ESC/RtbuPCBf6DZ7S0+NHhm1SHEbZyHFLkRXJm+IS
29oFmKrfXnXHckCrJFDZbOznRF6dVe7hV8CYi3FtoTjlRbuiHPQCMuy4ewCghAfv
eYxfB25AoTdBT7WiG8jd4w8D/iFweuqzTwcWtXEgDbDd21W9hNPLEELgguimCCdP
l3GHqw/MUJpIvdYfYhCzTaf4VpvkM5xlJGAcelCUL9qAufwyU8U8JI2YzlbqSlO8
qRwaiwq9qisTKEBb3IQadFqug+ihVdUeP8cuXPvbUEbFt7ILWyUD/kntgFdf1Apo
zZWlA/0SM45hV6yomcM7z08tyh4hZTrWX/RUJqe+U1niNAmzPg4P+r8SfXdIkjb2
fZT5h5cYLIiK+kUEkqyPmZwUlgMCCn4IYVd2pcKXKXWE8ympuf3E5wGYeiVpLBM/
th7qdEF87sViV8McfiRuXEonYrs1nSQZX+f4OxvTQqaP46u10rQsUHJvZ2VueSBT
ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBwcm9nZW55LmNvbT6IVwQTEQIAFwUCOsql
WQULBwoDBAMVAwIDFgIBAheAAAoJEEnBfSP5LU0f/sUAnjDpQs5SnFotNJ7GeIWx
Ftf7AvBBAJ0cygWS0XRXxJJq2PKbCbdln+i4d7kEDQQ6yqcjEBAA465SSuC/yvN7
WeZAN9XperqZtxLCVe8hLfrLZ+9/Xn2ysuEEe90rYe1X0HbsB/mInHF3VmT+XvHB
VdDQ7o0VMw7aeDgprt3jDQgT8gIesSOhZvulDujmLhykE+FT/V4lKpqO8prv7Ujs
AfuC7g/X2dcV1+imNOeivLaCM0+HrwUhdvifWFDwE97wBkrda/vhu9zs3NwMeBVN
UYfkRLPm+DGUSQVrteNiYJchhqfJB0mjrd+3FgnpCVgdU4c42epZ2ez/WTgTchoT
duMCd1sM9gzvQIih56KzxlGL82PVS2m0PNxSQ8iZpheMMGWregjpjpMRcrRbSXy+
WmPBacOiE/MyxXand+lGzig/9Srm6msUT5jE/lDcfySznJWH8B/fqD7KM5Z0ZM+b
3xV0PzGyMld+m3BfGolqsd5bpo8HaWCWsZVYfgdXjoDPYptsoPdLesN6WIAHA1kU
n2kckccz4xOoI/8MqKhkzZe0q5a9sv6RLBWDeVLxJnDuXZgcwCc4OvpcR4HnOE7c
U5VsyjYwTkzGWWuQxb8uxng3akHTK2PqeZAnC0tvtuwI7QFhOq/dzz+zHzVH2+Qh
55Aq6DjA9yEs3P7g31wb3duGdWtuIXn+N85GiJdZ1EmJESQCuOYOSHsV4bGxKcpg
PIpoSr5QBAUtUOTwN+xC8nNjZtC5OzsAAwYP/1OD/eiEraGpy7Z9scgXBjjb1kly
tgq06zGlSMWPEQoN3F87YeMiOsXSeDxJG+cnhvlys1Qoytp9/drsDLANi+Q61A/b
aka2IJLudiDu4iUDFb1rgRUERBciA31karPf2IwNjdU8lbulHfxQcjtjj7rbSWOG
gxzlPcLp2F5ee3h0qs+XW4UpD6K9f/u9gGT4nMr3owG06uNomlBAsGCVpk9XlRxG
x96161vrbmTPUx/o6NhqHNuf5Zh8ZmxQ3PYydywiE9njOtS04TTad24qbdPlVQh2
kjkTdsMCFRGaAB8EYImMT3F0ofon1Q/XWZrRlhkZpzuAKLhdSOW5G+tygNy2IqsH
wCYa/rDitYZeNN4EUb5At4HnSBCy86GFQgj+sDFO6yp+h7NLIMeTm0csaSbKEt6o
cbn0iMaRbLdHmAm0UHATPho+M2brf3mTztvAPONta2FC9TP1L1ojTDd4mtO9IcdM
hjOVqNbuyLXkWgPcSmwhhjB61p3/1M1Y/zfXxLOsi/XJlstYzzKzHa68F1e9dTEz
kgeYo1hG5TqMKv1sXfPJHw4N/QVcLoUlpUJZ/kI2OQD5mAhCCZ9PbT2fT4gLhy7U
sn0blh/R/0HFSFDwHgmx8mNfw7w0qFbba9/FEE8D5qhyyCx5KTk0OkvRL9OpzO7E
jzjdcfb6B2XpgSC8iEYEGBECAAYFAjrKpyMACgkQScF9I/ktTR90vgCggiX108DO
S3rhSkmfFuHey8w4RlIAn3nD+uCe+sjCFqVwb+LY2jO3ybjB
=6dRm
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjrfUEwACgkQScF9I/ktTR/NtACdGKnYB9ohZfD30nHz1F/nsQK9
2w4AnRvAyLz/e+8YnCvDmLUXOnvfDuC8
=DgRA
-----END PGP SIGNATURE-----

------------------------------

End of this Digest
******************

-- 
Raju Mathur          raju@xxxxxxxxxxxxx           http://kandalaya.org/