Solaris in.fingerd Crafted Request Information Disclosure

medium Nessus Network Monitor Plugin ID 1280

Synopsis

The remote host may give an attacker information useful for future attacks

Description

The remote finger server discloses the full list of its users when it receives the query "a b c d e f g h". An attacker may use this flaw to try to log in with the name of each account being displayed, hoping to find a null or trivial password.

Solution

Disable the finger service.

Plugin Details

Severity: Medium

ID: 1280

Family: Finger

Published: 8/20/2004

Updated: 3/6/2019

Nessus ID: 10788

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 5.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Reference Information

CVE: CVE-2001-1503

BID: 3457

Detections

Analytics