Excessive finger output
Summary
Some finger servers release too much information about an account.
Impact
Unnecessary information could be used as clues for guessing user passwords
or exploiting other system problems.
Background
The Bad Guys(tm) need information about users in order to take a guess at
their passwords. Most of them use the finger service to acquire the
necessary hints for mounting an attack. Some information can also
be used to compromising the user's account.
The problem
Some finger daemons release information about the user's shell, home
directory, and group membership. Information like this can be used for
an attack and is simply unnecessary. Information such the last time the
user logged in could be used to build a table of usage patterns.
By knowing a user's home directory and exploiting a problem in the mail
system, a cracker could create an entrance into the system. For example:
badguys $ echo "badguys.we-bad.org evilone" | uuencode /homes/bob/.rhosts | mail decode@victim.we-good.org
Fix
- Disable the finger daemon by commenting out the finger service in
/etc/inetd.conf and signaling inetd to reload its configuration.
- Use a finger daemon that is more restrictive or has access control such
as Mike Shazner's
fingerd.
- Control finger daemon requests by restricting its use to local and
trusted networks by using /etc/inetd.sec (on some systems, like HP) and/or
TCP
Wrappers