CVE-2001-0735 Buffer overflow in cfingerd 1.4.3 and earlier with the ALLOW_LINE_PARSING option enabled allows local users to execute arbitrary code via a long line in the .nofinger file.
HighCVSS 7.2
EPSS 1.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Buffer overflow in cfingerd 1.4.3 and earlier with the ALLOW_LINE_PARSING option enabled allows local users to execute arbitrary code via a long line in the .nofinger file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| infodrom cfingerd | = 1.4.1 | No fix listed |
| infodrom cfingerd | = 1.4.2 | No fix listed |
| infodrom cfingerd | = 1.4.3 | No fix listed |
| debian/cfingerd(Debian:12) | < 1.4.3-1.1 | 1.4.3-1.1 |
| debian/cfingerd(Debian:14) | < 1.4.3-1.1 | 1.4.3-1.1 |
| debian/cfingerd(Debian:13) | < 1.4.3-1.1 | 1.4.3-1.1 |
References
- DSA-066 patch vendor-advisory
- 20010711 Another exploit for cfingerd <= 1.4.3-8 mailing-list
- 20010621 cfingerd local vulnerability (possibly root) mailing-list patch vendor-advisory
- 2914 exploit patch vdb-entry vendor-advisory
- cfingerd-util-bo(6744) vdb-entry
- Debian Security Tracker CVE-2001-0735 vendor-advisory
- bugs.debian.org issue-tracking