322.txt

This is the snapshot of Snot Latest Rules

Rule:   

--
Sid: 322

-- 
Summary: 
This event is genrated when an attempt is made to query the finger daemon to ascertain a list of usernames on a system.

-- 

Impact: 
Information gatthering, the attacker may obtain the list of some accounts existing on the victim system as a prelude to further compromize.

--
Detailed Information:
This event is generated when an attempt to use a search feature in "cfingerd" version of a finger daemon is attempted. The search feature allows the attacker to obtain the lists of accounts existing on the target system by issuing a specially crafted finger request to "search" for information. Knowing the list of accounts might facilitate a password guessing attacks, email attacks or other abuse.

--
Attack Scenarios:
An attacker learns that "guest" account exists and has never been used. He then guesses that the password for this account and logs in to the system remotely using telnet.

-- 

Ease of Attack: 
Simple, no exploit software required

-- 

False Positives:
None Known

--
False Negatives: 
None Known

-- 

Corrective Action: 
Look for other IDS events involving the same IP addresses. 

Look for suspicious logins to the affected system.

Disable the finger daemon or apply a vendor patch that removes the vulnerability

--
Contributors: 
Original rule writer Max Vision <[e-mail]>
Snort documentation contributed by Anton Chuvakin <http://www.chuvakin.org>
Sourcefire Vulnerability Research Team
Nigel Houghton <[e-mail]>

-- 
Additional References:

OSVDB:
http://www.osvdb.org/32

--