Executive brief
A vulnerability in the cidentd identification service allows a standard user on a system to gain full administrative (root) control. The service, often used by IRC users to provide custom identity responses, fails to properly handle long lines of text in a user's configuration file. By creating a specially crafted file, a local attacker can crash the service and execute malicious commands with the highest level of system privileges.
Technical details
A stack-based buffer overflow exists in the cidentd daemon, specifically within the functions responsible for parsing the /etc/cident.users and ~/.authlie configuration files. The application uses fixed-size buffers of 1024 bytes to read lines from these files without performing adequate bounds checking. A local attacker can exploit this by creating a ~/.authlie file containing a line exceeding the buffer capacity, allowing for the overwrite of the instruction pointer. Since cidentd typically runs with root privileges to bind to privileged ports, successful exploitation results in local privilege escalation to root.
Affected products
- cidentd cidentd 1.2b and earlier
Timeline
- 1998-01-10: disclosed: Initial discovery and report on Bugtraq mailing list.
- 1998-01-10: advisory: NVD publication date.