Bug#724063: efingerd: Security risk with the default shell scripts

2013-09-23 Thread Radovan Garabik
On Sun, Sep 22, 2013 at 06:57:47PM +0200, steph...@bortzmeyer.org wrote: Package: efingerd Version: 1.6.2.7+nmu1 Severity: important Dear Maintainer, I'm afraid the default scripts in /etc/efingerd has a security weakness. They use $2 (the client IP address or host name) without

Bug#724063: efingerd: Security risk with the default shell scripts

2013-09-23 Thread Stephane Bortzmeyer
On Mon, Sep 23, 2013 at 05:37:47PM +0200, Radovan Garabik gara...@kassiopeia.juls.savba.sk wrote a message of 55 lines which said: The $2 is in quotes, and anyway it is invoked via execl(3), so I cannot find a way how to subvert the script - that is not to say I do not believe this is a

Bug#724063: efingerd: Security risk with the default shell scripts

2013-09-22 Thread stephane
Package: efingerd Version: 1.6.2.7+nmu1 Severity: important Dear Maintainer, I'm afraid the default scripts in /etc/efingerd has a security weakness. They use $2 (the client IP address or host name) without escaping it. Since the efingerd package runs by default *without* the -n option, $2 will