## Fingerd Vulnerability

### Risk Factor: 4

### Machines Affected:

All UNIXes running standard finger daemons.

### Description:

Finger is used to identify users on a system (to get email addresses or PGP keys, or whatever). Options like

    finger @victim.com

allow the intruder to see who is currently logged onto the system, and where they are logged on from.

### Consequences:

An intruder can get valuable information on who is on a system, which accounts to try to hack (since information like "last logged on:" is shown), etc.

### Fix:

Run a modified finger daemon such as gnufinger, bfingerd, cfingerd, or sfingerd.
OR
Disable the finger service in inetd.conf