Quick answers
- Is CVE-1999-0106 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-1999-0106 being exploited in the wild.
- How severe is CVE-1999-0106?
- Low severity, with a CVSS score of 2.1, published 1 March 1997.
- Which products and versions are affected?
- unknown fingerd.
- Is there a fix for CVE-1999-0106?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-1999-0106 attacked?
- It is attacked with local access, in a hosted service.
- Am I affected by CVE-1999-0106?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Finger daemon (fingerd) is vulnerable to a denial-of-service attack via finger redirection, commonly referred to as a 'finger bomb.' This occurs when a finger request is redirected to another host or back to the same host in a recursive manner. An attacker can exploit this by crafting a request that causes the service to enter an infinite loop or trigger a chain of requests that exhausts system resources (CPU or network sockets). This is a local-vector vulnerability as it typically involves manipulating how the local daemon handles incoming queries for user information. Mitigation generally involves disabling the finger service or configuring the daemon to disallow redirection.
Affected products
- unknown fingerd
Timeline
- 1997-03-01: disclosed: NVD Published Date