Bugtraq mailing list archives
Re: SunOS 4.1.4 fingerd
From: patrick () chloe dmv com (Patrick Ferguson)
Date: Mon, 20 May 1996 19:22:57 -0400
On Thu May 16 21:37:38 1996 Ed Arnold wrote:
andy () fred net said:Just messing around I picked up a couple "logic flaws" with sun 4.1.4 fingerd. This may happen on 4.1.X, but I haven't tested, and I am not motivated enough to check :> I know I have seen it written up someplace about the flaw when finger 0 () XXX com is done. (It shows a finger output on every user, which as we know, can be a very useful tool to those with bad intentions) Thus, we just added a user 0 (zero). Problem fixed. Anyway, I have found that fingering .@XXX.com also yeilds the same result.just fyi, in case you hadn't tried it ... tcpd does a nice job of stopping this nonsense.
We use tcpd (tcp-wrappers) to block outside finger connections on a machine, but I tested it by going to a machine that didn't have wrappers installed and was able to use the above concatenation (user@hidden@free.machine) to look at the users online. So I still have to modify the source for the fingers on any machine that won't run wrappers (like IRIX). ------------------------------------------------------------------------------ Patrick Ferguson - Systems Administrator patrick () dmv com DelMarVa OnLine! - Salisbury, MD -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBNAzGBrOQAAAECALpR8GMUAXnKbr9LeXVv18Q8y/n1NM1+YS8ffP/5HvM0gyso F1T9+gcGvb3L2nFwj+wnig0UQY93vXqhXPoFN4UABRG0IlBhdHJpY2sgRmVyZ3Vz b24gPHBhdHJpY2tAZG12LmNvbT4= =AgnQ -----END PGP PUBLIC KEY BLOCK-----
Current thread:
- Re: SunOS 4.1.4 fingerd, (continued)
- Re: SunOS 4.1.4 fingerd Kevin at Paranoia (May 16)
- Re: SunOS 4.1.4 fingerd Christopher X. Candreva (May 16)
- Re: SunOS 4.1.4 fingerd Niko Makila (May 16)
- Re: SunOS 4.1.4 fingerd Steve Coleman - SEWP (May 17)
- Re: SunOS 4.1.4 fingerd bitblt () bitblt resnet cornell edu (May 17)
- Re: SunOS 4.1.4 fingerd Yiorgos Adamopoulos (May 17)
- Re: SunOS 4.1.4 fingerd David B. Vanderpool (May 17)
- Re: SunOS 4.1.4 fingerd Taner Halicioglu (May 17)
- Re: SunOS 4.1.4 fingerd Craig Raskin (May 17)
- Re: SunOS 4.1.4 fingerd Ed Arnold (May 16)
- Re: SunOS 4.1.4 fingerd Patrick Ferguson (May 20)
- Re: SunOS 4.1.4 fingerd Eilon Gishri (May 21)
- Re: SunOS 4.1.4 fingerd Alan Brown (May 22)
- CERT Vendor-Initiated Bulletin VB-96.06 - FreeBSD CERT Bulletin (May 20)
- Re: SunOS 4.1.4 fingerd invalid opcode (May 16)
- Re: TCP SYN probe detection tool available Henri Karrenbeld (May 16)
- Re: TCP SYN probe detection tool available Brian Mitchell (May 16)
- Re: TCP SYN probe detection tool available Mike Neuman (May 16)
- Re: TCP SYN probe detection tool available Darren Reed (May 26)
- Re: TCP SYN probe detection tool available JaDe (May 16)