PT-2002-1478 · Effingerd · Effingerd

Published 2002-08-12 · Updated 2008-09-05 · CVE-2002-0424

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions efingerd versions 1.61 and earlier

Description The issue allows local users to gain privileges as the efingerd user by modifying their own .efingerd file and running finger, when efingerd is configured without the -u option. This is because, in such configurations, efingerd executes .efingerd files as the efingerd user, typically "nobody".

Recommendations For efingerd versions 1.61 and earlier, consider running efingerd with the -u option to prevent the execution of .efingerd files as the efingerd user. As a temporary workaround, restrict access to the .efingerd files to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-0424

Affected Products

Effingerd

References · 5

• http://iss.net/security_center/static/8381.php · Vendor Advisory
• http://securityfocus.com/bid/4240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0424 · Security Note
• http://melkor.dnp.fmph.uniba.sk/~garabik/efingerd/efingerd_1.6.2.tar.gz · Note
• http://archives.neohapsis.com/archives/bugtraq/2002-03/0050.html · Note