Bugtraq: Re: SunOS 4.1.4 fingerd

[era () ucar edu (Ed Arnold)]

andy () fred net said:

> Just messing around I picked up a couple "logic flaws" with sun 4.1.4
> fingerd. This may happen on 4.1.X, but I haven't tested, and I am not
> motivated enough to check :>
>
> I know I have seen it written up someplace about the flaw when
> finger 0 () XXX com is done. (It shows a finger output on every user, which
> as we know, can be a very useful tool to those with bad intentions)
>
> Thus, we just added a user 0 (zero). Problem fixed.
>
> Anyway, I have found that fingering . () XXX com also yeilds the same result.
just fyi, in case you hadn't tried it ... tcpd does a nice job of
stopping this nonsense.