Rule:

--
Sid:
358

--

Summary:
This event is generated when an attempt is made to login anonymously 
into an ftp server using a suspicious password (-saint)

--

Impact:
Possible unauthorized access. Information gathering.

--

Detailed Information:
Saint is an open-source security scanner which checks for common 
vulnerabilities. When it detects an open ftp server, it tries to log in 
anonymously using the password '-saint'

--

Affected Systems:
Machines running anonymous ftp servers.

--

Attack Scenarios:
An attacker scans a range of IPs using the Saint Scanner, checking for 
known vulnerabilities. If the scanner encounters a ftp server, it tries 
to log in .

--

Ease of Attack:
Simple.

--

False Positives:
A user may be using that same password for a legitimate 
anonymous login.

--

False Negatives:
None known.

--

Corrective Action:
Disable anonymous FTP access.

--

Contributors:
Original Rule Writer Max Vision <vision@whitehats.com>
Sourcefire Research Team
Nigel Houghton <nigel.houghton@sourcefire.com>
Snort documentation contributed by Chaos <c@aufbix.org>

-- 

Additional References:

Arachnids:
http://www.whitehats.com/info/IDS330

--
