Executive brief
A vulnerability in the Finger service, a legacy tool used to provide information about users on a network, allows for a denial-of-service attack known as a 'finger bomb.' By redirecting requests, an attacker can cause the system to enter an infinite loop or consume excessive resources. This can lead to service instability or system slowdowns, affecting the availability of the host.
Technical details
The Finger daemon (fingerd) is vulnerable to a denial-of-service attack via finger redirection, commonly referred to as a 'finger bomb.' This occurs when a finger request is redirected to another host or back to the same host in a recursive manner. An attacker can exploit this by crafting a request that causes the service to enter an infinite loop or trigger a chain of requests that exhausts system resources (CPU or network sockets). This is a local-vector vulnerability as it typically involves manipulating how the local daemon handles incoming queries for user information. Mitigation generally involves disabling the finger service or configuring the daemon to disallow redirection.
Affected products
- unknown fingerd
Timeline
- 1997-03-01: disclosed: NVD Published Date