CVE-2001-0735
cfingerd <= 1.4.3 - Buffer Overflow via Long Line in .nofinger File
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2001-0735. PoCs published by Megyer Laszlo, qitest1, teleh0r.
AI-analyzed exploit summary This exploit leverages a buffer overflow in cfingerd to overwrite the fopen function pointer with popen, allowing arbitrary command execution via the .nofinger file. It uses a format string attack to achieve this and requires local account access.
Description
Buffer overflow in cfingerd 1.4.3 and earlier with the ALLOW_LINE_PARSING option enabled allows local users to execute arbitrary code via a long line in the .nofinger file.
Exploits (3)
This exploit leverages a buffer overflow in cfingerd to overwrite the fopen function pointer with popen, allowing arbitrary command execution via the .nofinger file. It uses a format string attack to achieve this and requires local account access.
This exploit leverages a buffer overflow in cfingerd (CVE-2001-0735) by writing a malicious ~/.nofinger file containing shellcode and a manipulated return address. It targets specific Red Hat 6.2 configurations with cfingerd versions 1.4.0-1.4.3 to achieve local privilege escalation to root.
This exploit targets a buffer overflow in cfingerd (CVE-2001-0735) via the .nofinger file, allowing local privilege escalation to root. It includes two shellcode options: one for spawning a root shell in /tmp and another for making /etc/passwd writable.