cfingerd versions pre 1.4 insecure

A serious bug in cfingerd before version 1.4.0 has been reported. It is present in all versions of cfingerd from 1.2.0 up to any version of 1.3.2. If configured accordingly this bug enables any local user to execute random programs with root priviledges.

Although I haven't been quite verbose with development of cfingerd, Ken Hollis (the original author) has handed maintainership over to me a while ago. I did some development and fixed some security related bugs, but never made an official release. This is done now.

Affected systems ----------------

All systems running a version of cfingerd beginning with version 1.2.0 and before version 1.4.0 are affected.

You are safe if you have disabled ALLOW_EXECUTION in your cfingerd.conf file in section "internal_config", i.e. that file contains a line "-ALLOW_EXECUTION".

This is the default configuration of this package. If you use the default cfingerd.conf file as shipped with the distribution you are safe. You should still upgrade.

[modified] Exploit ------

Is available [/modified]

Recommended action ------------------

1st Immediately turn off ALLOW_EXECUTION in your cfingerd.conf file.

2nd Upgrade to the most recent version of cfingerd 1.4.0 to be found at the primary site ftp://ftp.infodrom.north.de/pub/people/joey/cfingerd/ or ftp://metalab.unc.edu/pub/Linux/system/network/finger/ .

Checksum --------

File: ftp://ftp.infodrom.north.de/pub/people/joey/cfingerd/cfingerd-1.4.0.tar.gz MD5sum: dcc25e89ba1dad6497365429b1db2909

Regards,

Joey