Debian Bug report logs - #700098
cfingerd: CVE-2013-1049 remote buffer overflow

version graph

Package: cfingerd; Maintainer for cfingerd is Martin Schulze <joey@debian.org>; Source for cfingerd is src:cfingerd.

Reported by: Marc Deslauriers <marc.deslauriers@ubuntu.com>

Date: Fri, 8 Feb 2013 18:06:01 UTC

Severity: grave

Tags: patch, security

Found in version cfingerd/1.4.3-3

Fixed in versions cfingerd/1.4.3-3.1, cfingerd/1.4.3-3+squeeze1

Done: Salvatore Bonaccorso <carnil@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Martin Schulze <joey@debian.org>:
Bug#700098; Package cfingerd. (Fri, 08 Feb 2013 18:06:04 GMT) Full text and rfc822 format available.

Acknowledgement sent to Marc Deslauriers <marc.deslauriers@ubuntu.com>:
New Bug report received and forwarded. Copy sent to Martin Schulze <joey@debian.org>. (Fri, 08 Feb 2013 18:06:04 GMT) Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Marc Deslauriers <marc.deslauriers@ubuntu.com>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: cfingerd: CVE-2013-1049 remote buffer overflow
Date: Fri, 08 Feb 2013 13:03:37 -0500
[Message part 1 (text/plain, inline)]
Package: cfingerd
Version: 1.4.3-3
Severity: normal
Tags: patch
User: ubuntu-devel@lists.ubuntu.com
Usertags: origin-ubuntu raring ubuntu-patch



*** /tmp/tmpntc4Ea/bug_body

In Ubuntu, the attached patch was applied to achieve the following:

  * SECURITY UPDATE: fix buffer overflow in rfc1413 (ident) client
    (LP: #1104425).
    - CVE-2013-1049

This vulnerability to have been introduced by the following:
 * Applied IPv6 patch from Mats Erik Andersson
     <mats.andersson@gisladisker.se> (closes: Bug#570024)

See dowstream bug report for more information:
https://bugs.launchpad.net/ubuntu/+source/cfingerd/+bug/1104425

Thanks for considering the patch.


-- System Information:
Debian Release: wheezy/sid
  APT prefers quantal-updates
  APT policy: (500, 'quantal-updates'), (500, 'quantal-security'), (500, 'quantal-proposed'), (500, 'quantal'), (100, 'quantal-backports')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.5.0-23-generic (SMP w/4 CPU cores)
Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
[cfingerd_1.4.3-3ubuntu2.debdiff (text/x-diff, attachment)]

Information forwarded to debian-bugs-dist@lists.debian.org, Martin Schulze <joey@debian.org>:
Bug#700098; Package cfingerd. (Fri, 08 Feb 2013 18:54:09 GMT) Full text and rfc822 format available.

Acknowledgement sent to Marc Deslauriers <marc.deslauriers@canonical.com>:
Extra info received and forwarded to list. Copy sent to Martin Schulze <joey@debian.org>.

Your message did not contain a Subject field. They are recommended and useful because the title of a $gBug is determined using this field. Please remember to include a Subject field in your messages in future.

(Fri, 08 Feb 2013 18:54:09 GMT) Full text and rfc822 format available.


Message #10 received at 700098@bugs.debian.org (full text, mbox):

From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: 700098@bugs.debian.org
Date: Fri, 08 Feb 2013 13:52:08 -0500
severity 700098 grave



Severity set to 'grave' from 'normal' Request was from Marc Deslauriers <marc.deslauriers@canonical.com> to control@bugs.debian.org. (Fri, 08 Feb 2013 19:03:03 GMT) Full text and rfc822 format available.

Added tag(s) security. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sat, 09 Feb 2013 16:06:03 GMT) Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Martin Schulze <joey@debian.org>:
Bug#700098; Package cfingerd. (Sat, 09 Feb 2013 18:21:06 GMT) Full text and rfc822 format available.

Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
Extra info received and forwarded to list. Copy sent to Martin Schulze <joey@debian.org>. (Sat, 09 Feb 2013 18:21:06 GMT) Full text and rfc822 format available.

Message #19 received at 700098@bugs.debian.org (full text, mbox):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 700098@bugs.debian.org
Subject: Propose to NMU cfingerd
Date: Sat, 9 Feb 2013 19:19:06 +0100
[Message part 1 (text/plain, inline)]
Hi Martin

Do you want to upload cfingerd? Otherwise I can prepare a NMU for this
issue with Marc's submitted patch. In any case I would upload it to a
delayed.

Regards,
Salvatore
[cfingerd-1.4.3-3.1-nmu.diff (text/x-diff, attachment)]

Information forwarded to debian-bugs-dist@lists.debian.org, Martin Schulze <joey@debian.org>:
Bug#700098; Package cfingerd. (Sat, 09 Feb 2013 21:36:04 GMT) Full text and rfc822 format available.

Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
Extra info received and forwarded to list. Copy sent to Martin Schulze <joey@debian.org>. (Sat, 09 Feb 2013 21:36:04 GMT) Full text and rfc822 format available.

Message #24 received at 700098@bugs.debian.org (full text, mbox):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 700098@bugs.debian.org
Subject: cfingerd: diff for NMU version 1.4.3-3.1
Date: Sat, 9 Feb 2013 22:34:08 +0100
[Message part 1 (text/plain, inline)]
tags 700098 + pending
thanks

Hi Martin,

I've prepared an NMU for cfingerd (versioned as 1.4.3-3.1) and
uploaded it to DELAYED/5. Please feel free to tell me if I
should delay it longer.

Note, I know with this upload I'm not strictly following the NMU
guidelines mentioned in the dev-ref (the bug is not enough old).
Thus, please let me know if I should cancel the upload and you would
like to do it yourself.

Regards,
Salvatore
[cfingerd-1.4.3-3.1-nmu.diff (text/x-diff, attachment)]

Added tag(s) pending. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sat, 09 Feb 2013 21:36:06 GMT) Full text and rfc822 format available.

Reply sent to Salvatore Bonaccorso <carnil@debian.org>:
You have taken responsibility. (Thu, 14 Feb 2013 21:51:03 GMT) Full text and rfc822 format available.

Notification sent to Marc Deslauriers <marc.deslauriers@ubuntu.com>:
Bug acknowledged by developer. (Thu, 14 Feb 2013 21:51:03 GMT) Full text and rfc822 format available.

Message #31 received at 700098-close@bugs.debian.org (full text, mbox):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 700098-close@bugs.debian.org
Subject: Bug#700098: fixed in cfingerd 1.4.3-3.1
Date: Thu, 14 Feb 2013 21:47:29 +0000
Source: cfingerd
Source-Version: 1.4.3-3.1

We believe that the bug you reported is fixed in the latest version of
cfingerd, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 700098@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated cfingerd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 09 Feb 2013 18:38:28 +0100
Source: cfingerd
Binary: cfingerd
Architecture: source amd64
Version: 1.4.3-3.1
Distribution: unstable
Urgency: high
Maintainer: Martin Schulze <joey@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Description: 
 cfingerd   - configurable finger daemon
Closes: 700098
Changes: 
 cfingerd (1.4.3-3.1) unstable; urgency=high
 .
   * Non-maintainer upload.
   * [SECURITY] CVE-2013-1049: fix buffer overflow in rfc1413 (ident) client.
     Thanks to Malcolm Scott <debianpkg@malc.org.uk> and Marc Deslauriers
     <marc.deslauriers@ubuntu.com> (Closes: #700098) (LP: #1104425)
Checksums-Sha1: 
 c924a00c0ecd4c366dd9350f57ce9f85db063673 1636 cfingerd_1.4.3-3.1.dsc
 f88b40808f8cdddd1b16040a473fc9a10570e751 21077 cfingerd_1.4.3-3.1.diff.gz
 a4674df151730a5f40b1330d3f34d2ce8ad19da6 80176 cfingerd_1.4.3-3.1_amd64.deb
Checksums-Sha256: 
 e0d4abcc1e2f7cb5a3e678a364a615b5c7a9d0c86c0f0979cec735fc5fa9587b 1636 cfingerd_1.4.3-3.1.dsc
 c5347a3f240d6725b000edf358494c0b0d37845bfaefd2712e844b61e178ff08 21077 cfingerd_1.4.3-3.1.diff.gz
 881bef70f5c5b00b8fced7a3b9b5b0170e9336716f60e4749159a1c5a5d892d3 80176 cfingerd_1.4.3-3.1_amd64.deb
Files: 
 e3260f7733e285355506370c5c205b55 1636 net extra cfingerd_1.4.3-3.1.dsc
 a734b1b547a1e3fb883c07eeacebcd8d 21077 net extra cfingerd_1.4.3-3.1.diff.gz
 fe2134483b5d0683196168bd9b1502a6 80176 net extra cfingerd_1.4.3-3.1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCgAGBQJRFr+4AAoJEHidbwV/2GP+uwoP/2ArGx64utG6mV3TUKuAAmqv
kSNhtbiWVWyQ44lPF+TCKvD3ulGPt9tHD60q2kxwlLJNmfoIELligExpq3oVCpnz
8X1Z3eKKNRqAt9Lx/2hmqZvG1vZJQ0CJu5vOl/RJDlgkEcpuWzLPOyyCQkfusV3U
HpbSWzEO1Ubzo2dEm7GYK3fmEJl07kNk4n2Vc9ji/Q43sBON7Y8/EcW24uE8EHho
Uw3YNqVZqlf8lkE+ucYe8SqGjcz5fepAxOD9QW7zI1AtdKeNhawpn3si+5ht/NbP
pPqnQga3NFBeJvgtliQhqU4nGJq1KcE5qcPWSMYlsrykfMyzT8A2oVnSyZBDu8B2
jmUuZdsK5Ah5k78jqYEHhs59eD841o+QpeUiW4DAa/5otv/1nOgG5hdj2mKMoXu/
c3Rr5X1+9F4v5I5Cn/XS7iNXtApc7S0fCJScUJ0HIuI/ljBZPuk2NYBL5GwM9dZw
Dk5NuzqGvN1fmB009LoEKO1+6DKDxGWskLp3Jqu4VI/U8bl2eYPVGhGtWKBb0MOH
XO1NujYZsEkDMgAWR/bogoW5240/7DNNHjLUKd+TBK6FXIypBQ6Yi0vxCThLDkC9
TsMl8wFYQNpfsWUXocyD/pX0iFebGdE3Zv2zKn8gFc7VncXjnCAKIdsRH2FAp9zy
XgZEC+bmUb/doqklLui7
=vcpL
-----END PGP SIGNATURE-----




Reply sent to Salvatore Bonaccorso <carnil@debian.org>:
You have taken responsibility. (Sat, 02 Mar 2013 19:06:13 GMT) Full text and rfc822 format available.

Notification sent to Marc Deslauriers <marc.deslauriers@ubuntu.com>:
Bug acknowledged by developer. (Sat, 02 Mar 2013 19:06:13 GMT) Full text and rfc822 format available.

Message #36 received at 700098-close@bugs.debian.org (full text, mbox):

From: Salvatore Bonaccorso <carnil@debian.org>
To: 700098-close@bugs.debian.org
Subject: Bug#700098: fixed in cfingerd 1.4.3-3+squeeze1
Date: Sat, 02 Mar 2013 19:02:04 +0000
Source: cfingerd
Source-Version: 1.4.3-3+squeeze1

We believe that the bug you reported is fixed in the latest version of
cfingerd, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 700098@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated cfingerd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 27 Feb 2013 21:30:04 +0100
Source: cfingerd
Binary: cfingerd
Architecture: source amd64
Version: 1.4.3-3+squeeze1
Distribution: stable-security
Urgency: high
Maintainer: Martin Schulze <joey@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Description: 
 cfingerd   - configurable finger daemon
Closes: 700098
Changes: 
 cfingerd (1.4.3-3+squeeze1) stable-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * [SECURITY] CVE-2013-1049: fix buffer overflow in rfc1413 (ident) client.
     Thanks to Malcolm Scott <debianpkg@malc.org.uk> and Marc Deslauriers
     <marc.deslauriers@ubuntu.com> (Closes: #700098) (LP: #1104425)
Checksums-Sha1: 
 ac5d9d4c679d41f86d08e7f3f88bd5dba4241559 1625 cfingerd_1.4.3-3+squeeze1.dsc
 47f19ecf667331a480d1c29b546ab0b02dc9008f 99898 cfingerd_1.4.3.orig.tar.gz
 9f7824ce1adb9ad9db54e925f9f2924a59eb246c 21383 cfingerd_1.4.3-3+squeeze1.diff.gz
 37357ae7fa400111070b1649270b14df2229b049 80190 cfingerd_1.4.3-3+squeeze1_amd64.deb
Checksums-Sha256: 
 4d8b855770e614d0e29405bfc62a2c34deae2841afe7333abee23c50f28c141f 1625 cfingerd_1.4.3-3+squeeze1.dsc
 61b5efdbbe881fe35c39ca243fc11cf52d219a4f61104f1052a900fc7acb0fb0 99898 cfingerd_1.4.3.orig.tar.gz
 6102389a72420bcb239a4ba6b206f162759e0a202feb432f064e51fc4b5398f7 21383 cfingerd_1.4.3-3+squeeze1.diff.gz
 92cced785a193337c56d645c147cbd09e995d5033a88b5f62a5107150aa864b6 80190 cfingerd_1.4.3-3+squeeze1_amd64.deb
Files: 
 4ff4884e8cbfb37f970151e5f0a477ad 1625 net extra cfingerd_1.4.3-3+squeeze1.dsc
 fe9365f811624248aa3df52c4a832fc7 99898 net extra cfingerd_1.4.3.orig.tar.gz
 8ddecbcfcc52599032f72c38c6de8173 21383 net extra cfingerd_1.4.3-3+squeeze1.diff.gz
 0aabf97f019eaa1fb7f66d07d86e67c6 80190 net extra cfingerd_1.4.3-3+squeeze1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCgAGBQJRL7o6AAoJEHidbwV/2GP+rLQP/1YIz1pFDu4qTTYUN6zIFnKb
Vl0ZmEZH8M5SaT7vX5bSUxEZ8gcykqaiIPoI/VyBWHL03T3r4Ldu+uWu8MTxFWWn
fanJrSok+WqhQCDAyQ0LFS5mSJ/lz24xWiasKhjjW/MQLM51yYtH5QKN+SdjtUjp
lH/W9AlyaJ2LHBSS3bjeId6SLqr7PGBI2JcnkNwyLxv722VGp2WzmLH8HqjWewjH
6K5a/H8vkfpMVx5pZKgQ+49vlrsl+ccowm40MS6HCbhXcQYEpoGrekY/2fuPJuyr
6Q+4v8HP1ak2QCBYeZh+YyBloH7wiQPLxprDDAEyPwtGt4FuEm19s0V9p9uOs9MB
H/rQTpOHnc3fAAwhVP+v2Wcm/QJtVUe9hNG28TCURHzxkyAFJ8vy1+Z9JNSnl8f+
Io3m+0GlPfKKNZ+cI4SO0rLmJBiEtD7lfqCD5qa+TyEby0S3nwa9KClZM6pnuyO4
rJRe6CYiVQ96ux6FfUX3wVpPtg+qpim0aKK1RtZRKXdoW+8qk26TPSeDiYtEfm37
7s55VCJt+2sSxkPhjxCyw3lG1cmhlP68X67t0kRLAIifJpZlwr1LMiPaqOV4Por3
9XUKaaML1CPpPNDl+XBw27aIJi7veGhtjmLKhJCU2L8iqyOUGXnmApMN/tBmIvX7
qElmNZ5/IUAQpWYGdeQu
=Vuv2
-----END PGP SIGNATURE-----




Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sun, 02 Jun 2013 08:32:58 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Mon Apr 21 08:03:31 2014; Machine Name: beach.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.