PT-2002-1478 · Effingerd · Effingerd

Publicado 2002-08-12 · Atualizado 2008-09-05 · CVE-2002-0424

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions efingerd versions 1.61 and earlier

Description The issue allows local users to gain privileges as the efingerd user by modifying their own .efingerd file and running finger, when efingerd is configured without the -u option. This is because, in such configurations, efingerd executes .efingerd files as the efingerd user, typically "nobody".

Recommendations For efingerd versions 1.61 and earlier, consider running efingerd with the -u option to prevent the execution of .efingerd files as the efingerd user. As a temporary workaround, restrict access to the .efingerd files to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2002-0424

Produtos afetados

Effingerd

Referências · 5

• http://iss.net/security_center/static/8381.php · Aviso do Fabricante
• http://securityfocus.com/bid/4240 · Aviso do Fabricante
• http://melkor.dnp.fmph.uniba.sk/~garabik/efingerd/efingerd_1.6.2.tar.gz · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0424 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2002-03/0050.html · Nota