CVE-1999-1165 - GNU fingerd 1.37 does not properly drop privileges before accessing user information, which could allow local users to (1) gain root privileges via a malicious program in the .fingerrc file, or (2) read arbitrary files via symbolic links from .plan, .forward, or .project files

Back Back to CVE browser

HIGH

GNU fingerd 1.37 does not properly drop privileges before accessing user information, which could allow local users to (1) gain root privileges via a malicious program in the .fingerrc file, or (2) read arbitrary files via symbolic links from .plan, .forward, or .project files

Published Sep 12, 2001

7.2

HIGH

CVSS 2.0

EPSS 0.46%

Description

GNU fingerd 1.37 does not properly drop privileges before accessing user information, which could allow local users to (1) gain root privileges via a malicious program in the .fingerrc file, or (2) read arbitrary files via symbolic links from .plan, .forward, or .project files.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (4)

http://marc.info/?l=bugtraq&m=93268249021561&w=2
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/archive/1/2478
mailing-listx_refsource_BUGTRAQExploitVendor Advisory
http://www.securityfocus.com/bid/535
vdb-entryx_refsource_BIDPatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-1999-1146
Advisory

Link	Providers	Tags
http://marc.info/?l=bugtraq&m=93268249021561&w=2		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/archive/1/2478		mailing-listx_refsource_BUGTRAQExploitVendor Advisory
http://www.securityfocus.com/bid/535		vdb-entryx_refsource_BIDPatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-1999-1146		Advisory