GNU Fingerd vulnerabilities

3 CVEs affecting GNU Fingerd, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-1999-1165, published 1999-07-21.

More from GNU.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-1999-0612, published 1997-03-01. Low severity, CVSS 0.0. EPSS: 68% chance of exploitation in the next 30 days. A version of finger is running that exposes valid user information to any entity on the network.
• CVE-1999-0150, published 1997-07-01. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. The Perl fingerd program allows arbitrary command execution from remote users.
• CVE-1999-1165, published 1999-07-21. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. GNU fingerd 1.37 does not properly drop privileges before accessing user information, which could allow local users to (1) gain root privileges via a malicious program in the .fingerrc file, or (2)…