• info
• discussion
• exploit
• solution
• references

cfingerd Buffer Oveflow Vulnerability

Solution:
Debian 2.1, which ships with cfingerd 1.3.2-18 is known to be patched.
The following patch was offered by Larry W. Cashdollar in his BugTraq posting on July 2, 1999:

(cut the diff, use patch to apply to parse.c)

From Larry's post:

[root@dt065n87 src]# diff parse.old parse.c
78c78
< char parsed[80];
---
> char parsed[100];
80c80
< bzero(parsed, 80);
---
> bzero(parsed, 100);