Detections
Analytics
cfingerd < 1.4.4 Multiple Vulnerabilities
critical Nessus Plugin ID 10652
Synopsis
The remote finger service has multiple vulnerabilities.Description
The version of cfingerd running on the remote host has multiple vulnerabilities, including :- A local buffer overflow in the GECOS field, which can be used to escalate privileges.
- A format string vulnerability, triggered by a malformed ident reply. This can be used to execute arbitrary code.
- A local privilege escalation issue.
Solution
Upgrade to cfingerd version 1.4.4 or later.See Also
Plugin Details
Severity: Critical
ID: 10652
File Name: cfinger_format_bug.nasl
Version: 1.27
Type: remote
Family: Misc.
Published: 4/16/2001
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
Required KB Items: cfingerd/version
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 9/19/1996