Bugtraq mailing list archives

Re: login can be used to hide from finger under SunOS 4.13u1

From: casper () Holland Sun COM (Casper Dik)
Date: Fri, 02 Jun 1995 09:36:29 +0200

I recently noticed that running login (no arguments) once logged in, and 
providing it with your username and password would hide one from finger 
requests under SunOS 4.13u1.  Has anybody else noticed this, under SunOS, or 
other unix variants?



Yes.  Simple fix:

        chmod u-s /bin/login

Has never given us any trouble.

Casper

Current thread:

Re: [8lgm]-Advisory-17.UNIX.sendmail Mark Graff (Jun 01)
- login can be used to hide from finger under SunOS 4.13u1 David Sacerdote (Jun 01)
  - Re: login can be used to hide from finger under SunOS 4.13u1 Casper Dik (Jun 02)
  - rlogin can be used to change finger information Bonfield James (Jun 02)
    - Cisco IP packet filtering vulnerablility Paul Traina (Jun 01)
    - Re: Cisco IP packet filtering vulnerablility Darren Reed (Jun 02)
    - lsof 3.29 -- good news and bad Vic Abell (Jun 02)
    - Re: rlogin can be used to change finger information Casper Dik (Jun 02)
  - Re: login can be used to hide from finger under SunOS 4.13u1 Karl Strickland (Jun 02)
- Re: [8lgm]-Advisory-17.UNIX.sendmail Karl Strickland (Jun 01)