Test ID:	1.3.6.1.4.1.25623.1.0.10788
Category:	Finger abuses
Title:	Solaris finger disclosure
Summary:	NOSUMMARY
Description:	Description: There is a bug in the remote finger service which, when triggered, allows a user to force the remote finger daemon to display the list of the accounts that have never been used, by issuing the request : finger 'a b c d e f g h'@target This list will help an attacker to guess the operating system type. It will also tell him which accounts have never been used, which will often make him focus his attacks on these accounts. Solution : disable the finger service in /etc/inetd.conf and restart the inetd process, or apply the relevant patches from Sun Microsystems. Risk factor : Medium
Cross-Ref:	BugTraq ID: 3457 Common Vulnerability Exposure (CVE) ID: CVE-2001-1503 http://www.securityfocus.com/bid/3457 http://sunsolve.sun.com/search/document.do?assetkey=1-26-27116-1 http://archives.neohapsis.com/archives/vulnwatch/2001-q4/0016.html XForce ISS Database: solaris-fingerd-list-accounts(7334) https://exchange.xforce.ibmcloud.com/vulnerabilities/7334
Copyright	This script is Copyright (C) 2001 Renaud Deraison

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.