There MAY be a way for the user to run a program in response to a Finger query. See section 3.2.5 for caveats. 3 Security 3.1 Implementation security Sound implementation of Finger is of the utmost importance. Implementations should be tested against various forms of attack. Vendors providing Finger with the operating system or network software should subject their implementations to penetration testing.
Finger is one of the avenues for direct penetration, as the Morris worm pointed out quite vividly.
Like Telnet, FTP and SMTP, Finger is one of the protocols at the security perimeter of a host. Accordingly, the soundness of the implementation is paramount. Security administrators should make explicit decisions about whether to run Finger and what information should be provided in responses. This makes it possible to track conversations in progress and see where someone's attention was focused. Sites that are information-security conscious should not run Finger without an explicit understanding of how much information it is giving away.