Decfingerd Honeypot Finger Server May Let Remote Users Execute Commands on the System
|
|
SecurityTracker Alert ID: 1004644 |
|
SecurityTracker URL: http://securitytracker.com/id/1004644
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 27 2002
|
Impact:
Execution of arbitrary code via network, Root access via network, User access via network
|
|
Version(s): 0.7
|
Description:
A format string vulnerability was reported in the 'decfingerd' deception finger daemon. A remote user could cause arbitrary commands to be executed on the system with the privileges of the daemon.
The vulnerability is reportedly due to an unsafe syslog() function call. User supplied input is provided to syslog without the software having performing input validation to ensure that only valid characters are passed.
A remote user could send a specially crafted request to the daemon to cause arbitrary shell commands to be executed by the daemon.
Decfingerd is a 'honeypot' finger daemon that provides bogus replies to the requestor. It is available at:
http://packetstormsecurity.nl/UNIX/IDS/decfingerd-0.7.tar.gz
|
Impact:
A remote user could execute arbitrary comands on the system with the privileges of the decfingerd service.
|
Solution:
No solution was available at the time of this entry.
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 25 Jun 2002 03:12:27 -0700
Subject: Formatstring Vulnerability in decfingerd 0.7
|
Hello all,
I have no idea if this is the most current version of this application, I
found it while browsing packetstormsecurity earlier. For all I know it may
not even be kept current anymore.
Anyhow... bad call to syslog() is the culprit. I'm to lazy to code an
exploit for this at the moment but it should be fairly trivial to do if
anyone is interested in the task:
Culprit code: decfingerd.c
int main(void):
char input[20], message[100];
fgets(input, sizeof(input), stdin);
sprintf(message, "Client %s requested info for %s\n", remoteIP,
input);
syslog(0, message, sizeof(message));
Have a good one,
isox
---
- isox@chainsawbeer.com
- http://0xc0ffee.com
---
|
|
