Rule: -- Sid: 324 -- Summary: This event is generated when a null character in a Finger request is detected. -- Impact: Some systems will respond to a null finger request by supplying a list of usernames present on the host. Disclosure of usernames is an Information Gathering risk. The remote user can use this information in other exploits that require knowing user names, or as a basis for social engineering. -- Detailed Information: A packet is transmitted to server port 79 (Finger) with a null character in the data. Some Unix finger commands will respond with a full list of usernames. A remote attacker could use this information for other exploits, including dictionary-based password attacks and social engineering attempts. -- Affected Systems: Some UNIX based systems -- Attack Scenarios: See detailed information section above. -- Ease of Attack: Simple. -- False Positives: None known -- False Negatives: None known -- Corrective Action: Disable the finger daemon in inetd.conf, or block untrusted access to port 79 using a packet filtering firewall. -- Contributors: Original Rule Writer Unknown Sourcefire Research Team Nigel Houghton <nigel.houghton@sourcefire.com> Snort documentation contributed by Darryl Davidson <ddavidson@talisman-intl.com> -- Additional References: CVE-1999-0612, Arachnids: http://www.whitehats.com/info/IDS377 (Arachnids,377) --
