PT-2002-2811 · Deception · Deception Finger Daemon

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2091

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Deception Finger Daemon version 0.7

Description: A format string issue in the Deception Finger Daemon may allow remote attackers to execute arbitrary code via the username of a finger request.

Recommendations: For Deception Finger Daemon version 0.7, consider disabling the handling of finger requests until a patch is available. Restrict access to the daemon to minimize the risk of exploitation. Avoid using the username variable in the affected request handling until the issue is resolved.

Fix

Related Identifiers

CVE-2002-2091

Affected Products

Deception Finger Daemon

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-2091 · Security Note
• http://iss.net/security_center/static/9434.php · Note
• http://securityfocus.com/bid/5105 · Note
• http://archives.neohapsis.com/archives/bugtraq/2002-06/0314.html · Note