Vulnerability Details CVE-2002-0424
efingerd 1.61 and earlier, when configured without the -u option, executes .efingerd files as the efingerd user (typically "nobody"), which allows local users to gain privileges as the efingerd user by modifying their own .efingerd file and running finger.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 21.4%
CVSS Severity
CVSS v2 Score 4.6
References
- http://archives.neohapsis.com/archives/bugtraq/2002-03/0050.html
- http://melkor.dnp.fmph.uniba.sk/~garabik/efingerd/efingerd_1.6.2.tar.gz
- http://www.iss.net/security_center/static/8381.php
- http://www.securityfocus.com/bid/4240
- http://archives.neohapsis.com/archives/bugtraq/2002-03/0050.html
- http://melkor.dnp.fmph.uniba.sk/~garabik/efingerd/efingerd_1.6.2.tar.gz
- http://www.iss.net/security_center/static/8381.php
- http://www.securityfocus.com/bid/4240