PFinger Format String Vulnerability (Format String)
17 Dec. 2002
Summary
PFinger is an open-source replacement of the GNU Finger daemon. PFinger suffers from a format string vulnerability that, when exploited, can allow the remote execution of arbitrary code.
Vulnerable systems:
* PFinger version 0.7.8 and earlier
The format string vulnerability arises due to an unsafe call to syslog() in the log() function of log.c
..
syslog(level, syslog_mem);
..
To make this safe a format string should be specified:
..
syslog(level,"%s", syslog_mem);
..
Due to the way requests are logged the only way to exploit this vulnerability is through setting the DNS name of the fingering host to the attacker supplied format string.
if (h_ent)
conn.hostname = strdup(h_ent->h_name);
else
conn.hostname = "(remote)";
log(LOG_INFO, "Connection from %s (%s)",conn.hostname,inet_ntoa(remaddr.sin_addr));
This code looks up the Domain name of the fingering host and logs the connection information. This appears to be the only place where user controlled data is logged. For exploitation to succeed the attacker must either control their own DNS, the DNS server of the target host or alternatively spoof the DNS reply. This makes exploitation more difficult but by no means impossible.
Fix Information:
NGSSoftware alerted the author of PFinger with this problem on the 27th of November, 2002. The author has responded and assured NGS that a fix will be implemented shortly. Those who are comfortable with C and cc/gcc can fix these themselves by editing log.c in the manner described in the "Details" section above.
