CVE-2007-4310: Medium severity Sun SunOS vulnerability

Published Aug 13, 2007

Updated

The finger daemon (in.fingerd) in Sun Solaris 7 through 9 allows remote attackers to list all accounts that have certain nonstandard GECOS fields via a request composed of a single digit, as demonstrated by a "finger 9@host" command, a different vulnerability than CVE-2001-1503.

Affected Software

3 affected components

Sun SunOS=5.7

Sun SunOS=5.8

Sun SunOS=5.9

Event History

Aug 13, 2007

CVE Published

09:17 PM

Aug 14, 2007

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4310?

CVE-2007-4310 is considered a moderate severity vulnerability due to its potential for exposing sensitive user account information.

How do I fix CVE-2007-4310?

To fix CVE-2007-4310, you should disable the finger daemon (in.fingerd) or apply security patches provided by the vendor for affected Solaris versions.

What versions of Sun Solaris are affected by CVE-2007-4310?

CVE-2007-4310 affects Sun Solaris versions 7 through 9 specifically.

What does CVE-2007-4310 allow attackers to do?

CVE-2007-4310 allows remote attackers to list all user accounts with certain nonstandard GECOS fields via a crafted finger command.

Is there a workaround for CVE-2007-4310?

A common workaround for CVE-2007-4310 is to configure firewalls to block port 79 where the finger daemon operates.