Excessive Finger Information CVE 1999-0612 Summary Certain finger servers, when queried, will release excess data about accounts on the system. This excess information could be used as clues for guessing user passwords or exploiting other system problems. The finger command provides information about users on a system.
Intruders require information about users in order to guess their passwords.
The finger service is the most common method of acquiring the necessary hints for cracking user passwords and compromising a user's account. Some finger daemons release information about the user's shell, home directory and group membership. This information may be used by hackers to attack the system. Some of the information can also be used to compromise the user account. For example, information such as the last time a user logged into the system could be used to build a table of usage patterns.