Executive brief
The finger utility, a tool used to look up user information on a network, contains a flaw that allows for recursive searches. By providing a long string of specific characters, a user can cause the system to perform excessive lookups. This can lead to a minor disruption of service or resource exhaustion on the affected system.
Technical details
The finger daemon/utility fails to properly validate or limit the depth of recursive queries when processing input containing multiple '@' symbols. An attacker can exploit this by providing a long string of '@' characters (e.g., user@@@host), forcing the service to perform repeated, nested lookups. This is a resource exhaustion vulnerability that can lead to a local denial of service. The vulnerability is triggered via local command-line interaction or network requests depending on the specific finger implementation. Modern versions of finger typically include protections against such recursive loops.
Affected products
- unknown finger
Timeline
- 1997-03-01: disclosed: NVD Published Date