[linux-security] cfingerd remote root exploit

[Martin Siegert <siegert@sfu.ca>]

Topic
=====
remote root exploit in cfingerd

Problem Description
===================
cfingerd has bugs in its logging code. By combining these with an off-by-one
error in the code that copied the username from an ident response cfingerd
could exploited by a remote user. Since cfingerd does not drop its root
privileges until after it has determined which user to finger an attacker
can gain root privileges.

Affected Systems
================
Systems that use cfingerd: Debian

Workaround (recommended!)
=========================
Do not run cfingerd or any finger daemon for that matter.
Comment out the corresponding line in /etc/inetd.conf and
"kill -HUP <pid of inetd>".

Solution
========
Debian 2.2 (potato)
-------------------
update to cfingerd_1.4.1-1.1_i386.deb