Bugtraq mailing list archives

Re: finger-bombing


From: marc () dumbcat sf ca us (Marco S Hyman)
Date: Thu, 13 Oct 1994 23:13:19 -0700


Scott Chasin writes:

The same hack in a different fashion on SunOS 4.1.x will give random users
profiles (at least from what I have seen.. At one time I thought not).

Example: finger 23234123123123123 () some sunos host com

SunOS 4.1.3 using your example:

dumbcat> finger 23234123123123123
Login name: audit     
Directory: /etc/security/audit          Shell: /bin/false
Never logged in.
No unread mail
No Plan.

Note that finger 0 or finger 9999999999999999 all give the same response.

// marc



Current thread: