vendor:
cfingerd
by:
babcia padlina ltd.
7.5
CVSS
HIGH
Buffer Overflow
119
CWE
Product Name: cfingerd
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: NO
Related CWE:
CPE: a:cfingerd_project:cfingerd
Platforms Tested: FreeBSD
Unknown
cfingerd Local Root Exploit
cfingerd is vulnerable to a local root (or nobody) buffer overflow. By setting a carefully designed GECOS field, it is possible to execute arbitrary code with root (or nobody) privileges.
Mitigation:
Update cfingerd to a non-vulnerable version or apply a patch if available. Limit the length of the GECOS field to prevent buffer overflow.
