From owner-freebsd-bugs  Thu Jan  8 16:20:43 1998
Return-Path: <owner-freebsd-bugs>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id QAA22600
          for bugs-outgoing; Thu, 8 Jan 1998 16:20:43 -0800 (PST)
          (envelope-from owner-freebsd-bugs)
Received: (from gnats@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id QAA22509;
          Thu, 8 Jan 1998 16:20:06 -0800 (PST)
          (envelope-from gnats)
Date: Thu, 8 Jan 1998 16:20:06 -0800 (PST)
Message-Id: <199801090020.QAA22509@hub.freebsd.org>
To: freebsd-bugs
Cc: 
From: Jan Koum <jkb@best.com>
Subject: Re: bin/5434: "backdoor" in fingerd allows execution of commands
Reply-To: Jan Koum <jkb@best.com>
Sender: owner-freebsd-bugs@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

The following reply was made to PR bin/5434; it has been noted by GNATS.

From: Jan Koum <jkb@best.com>
To: fosters@dvalley.demon.co.uk
Cc: FreeBSD-gnats-submit@freebsd.org, GNATS Management <gnats@freebsd.org>,
        freebsd-bugs@hub.freebsd.org
Subject: Re: bin/5434: "backdoor" in fingerd allows execution of commands
Date: Thu, 8 Jan 1998 16:09:35 -0800 (PST)

 On Mon, 5 Jan 1998 fosters@dvalley.demon.co.uk wrote:
 
 >
 >>How-To-Repeat:
 >
 >	At a shell prompt type:
 >	
 >	% finger `ls`
 >	
 >	Will give a directory listing of the current directory. If you telnet
 >	to port 79, you can use it almost like a shell.. e.g.
 >	
 >	% telnet localhost 79
 >	
 >	then type:
 >	
 >	`rm -R /`
 >	
 >	and say goodbye to /. fingerd was running as root on my system, bad
 >	news!
 >
 
 	Did you actually try it on your system?
 
 -- Yan
 
 >>Fix:
 >	
 >	Comment out fingerd from the inetd.conf and reboot or kill -HUP 126
 >
 >>Audit-Trail:
 >>Unformatted:
 >