CVE-1999-0612: Finger service exposes valid user information to network

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: low.

medium priorityInformation disclosure only, with no code execution or confirmed exploitation, but high EPSS and trivial network reachability make it worth remediating.

What it is

The finger service is running in a configuration that discloses valid user account information to any entity that can reach it on the network. This is an information disclosure flaw rather than a code execution bug, but it gives attackers reliable reconnaissance data. The record is very thin: no CVSS score, no affected version detail, and only generic references.

Impact

An attacker learns which user accounts exist on the host, which is directly useful for username enumeration ahead of password guessing or other targeted attacks. No code execution or privilege escalation is described in the record.

Attack surface

Reachable over the network via the finger service; the description states any entity on the network can obtain the information, implying no authentication is required. No user interaction is indicated.

Exploitation

Not listed in CISA KEV and no exploit references are tagged, but EPSS is high at roughly 0.68 (99th percentile), suggesting elevated predicted exploitation activity despite the absence of confirmed in-the-wild reporting.

What to do

• Disable or remove the finger service (fingerd) on hosts that do not require it.
• If finger must run, restrict access to trusted hosts or networks with firewall rules or TCP wrappers.
• Apply vendor patches or updates for the affected finger implementation where available.
• Audit for other legacy information-disclosure services and retire them where possible.

Detection

• Monitor network traffic and logs for inbound connections to TCP port 79 (finger).
• Alert on finger queries originating from hosts outside expected administrative ranges.
• Inventory hosts with fingerd listening and flag any that are internet-exposed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.