## Finger Bomb Vulnerability

### Risk Factor: 7

### Machines Affected:

Most UNIXes running fingerd

### Description:

Remote fingering allows one to finger through machines like so:

    evil/~> finger johndoe@victim.com@target.com

This will effectively appear as johndoe being fingered at victim.com by someone from target.com. Since fingerd can read this way, a hacker could do:

    evil/~> finger johndoe@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@victim.com

This would cause victim.com to finger itself recursively.

### Consequences:

If victim.com fingers itself recursively enough, eventually memory, swap space, and then hard drive space will fill up, causing the machine to crash

### Fix:

Disable fingerd by commenting out the finger line in inetd.conf and kill -HUP inetd process.

Get GNU Finger from MIT

Links for advisories/more info none