Bugtraq: Re: fingerd problems

[sopwith () dilbert redhat com (Elliot Lee)]

> [ list of ways to list all the users on a system using fingerd ]
Another vulnerability of many finger daemons is their ability to support
'chain' fingers. If they are passed a "username" in the form of
'user () ahost net' the finger daemon will repeat the finger, effectively
hiding the tracks of anyone trying to scope out your system security.

For a demonstration, 'telnet prep.ai.mit.edu 79' and type
'[yourname] () [yourhost]'. If you have TCP wrappers installed, you will
notice that the finger connection comes from prep.ai.mit.edu, not [yourhost].

Elliot Lee