CVE-2004-2272

Vulnerability

A buffer overflow vulnerability exists in the sockFinger_DataArrival function of efFingerD version 0.2.12. The flaw is triggered when the daemon receives a finger command that exceeds the length of an internal fixed-size buffer, leading to memory corruption and a crash of the fingerd process [1].

Exploitation

An attacker can exploit this vulnerability remotely without any prior authentication or user interaction. By sending an overly long finger command to the target service on the default finger port (79/TCP), the attack causes the buffer overflow, resulting in immediate denial of service. No special network position or privileges are required [1].

Impact

Successful exploitation results in a denial of service due to the daemon crashing. There is no indication of code execution or privilege escalation; the impact is limited to service unavailability until the daemon is manually restarted [1].

Mitigation

No official patch or updated version has been released for this vulnerability. According to the advisory, users should consider disabling the finger service or using an alternative finger daemon to mitigate the risk [1].