CVE-2002-0424: efingerd 1.61 and earlier, when configured without the -u option, executes .efingerd files as the efingerd...

Security readout for executives and security teams

This vulnerability affects efingerd 1.61 and earlier when it is not started with the -u option. A local user can make their own .efingerd file run under the efingerd service account, commonly nobody. The business risk is mainly on legacy Unix-like systems that still provide finger services to users. Exposure is likely limited to legacy systems running efingerd 1.61 or earlier, with finger service enabled and local users able to create or modify .efingerd files. Internet exposure of finger may increase discovery risk, but the described privilege gain requires local user control. Treat this as a legacy exposure cleanup item. It is not evidenced as actively exploited, but it can weaken multi-user systems and should be removed or hardened during standard vulnerability remediation. Mitigation focus: Start efingerd with the -u option where applicable.; Disable efingerd or finger service if not business-required.; Restrict local user ability to create executable .efingerd files..

Prepared

Jun 30, 2026, 13:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.