Rule: --Sid:3151-- Summary: This event is generated when an attempt is made to access the hostfilestem via fingerd.-- Impact: Information gathering.--Detailed Information:This event is generated when a specific attack against a vulnerableversion of the finger daemon is detected. The Finger daemon is used to provide information about users on a UNIXsystem. A certain version of fingerd shipped with one release of FreeBSD4.1.1 contained an added feature that allows a remote user to requestsome files via the use of finger. This event indicates that such arequest has been made.The feature also allowed any file or directory structure on the hostreadable by the "nobody" user to also be accessed, leading tounauthorized information disclosure.--Affected Systems:	FreeBSD 4.1.1 Release--Attack Scenarios:  An attacker can use finger to read a directory structure or file bymaking a request via finger.-- Ease of Attack: Simple, no exploit software is required, just a specially formattedfinger query.-- False Positives: None Known--False Negatives: None Known-- Corrective Action: Disable the finger daemon or limit the addresses that can access theservice via a firewall or TCP wrappers.--Contributors: Sourcefire Vulnerability Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>-- Additional References:--