Executive brief
cfingerd is a service used to provide information about users logged into a system. A vulnerability in this service allows remote individuals to retrieve a complete list of all user accounts on the server. This information can be used by attackers to facilitate targeted password-guessing attacks or other malicious activities against specific users.
Technical details
The cfingerd daemon contains an information disclosure vulnerability where it fails to properly restrict user enumeration. By sending a specific finger request formatted as 'search.**@target', a remote, unauthenticated attacker can trigger the service to return a list of all users registered on the system. This is a classic user enumeration flaw that facilitates reconnaissance for further attacks. The vulnerability is reachable over the network via the finger protocol (typically port 79).
Affected products
- cfingerd cfingerd
Timeline
- 1997-05-23: disclosed