From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Tue, 24 Sep 2002 18:26:18 +0300 From: Michael Shigorin To: community@altlinux.ru, sisyphus@altlinux.ru Message-ID: <20020924152618.GC90080@osdn.org.ua> Mail-Followup-To: community@altlinux.ru, sisyphus@altlinux.ru Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="WYTEVAkct0FjGQmd" Content-Disposition: inline User-Agent: Mutt/1.5.1i Subject: [sisyphus] Fwd: Slapper worm redux; Sender: sisyphus-admin@altlinux.ru Errors-To: sisyphus-admin@altlinux.ru X-BeenThere: sisyphus@altlinux.ru X-Mailman-Version: 2.0.13 Precedence: bulk Reply-To: sisyphus@altlinux.ru List-Unsubscribe: , List-Id: List-Post: List-Help: List-Subscribe: , List-Archive: Archived-At: List-Archive: --WYTEVAkct0FjGQmd Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable FYI ----- Forwarded message from Ron DuFresne ----- Date: Tue, 24 Sep 2002 08:53:37 -0500 (CDT) From: Ron DuFresne To: firewalls@isc.org Subject: Slapper worm redux; Those folks relying upon security through obscurity might well wish to get on the ball and fully patch-up; September 23 VNUNET.COM. A suspect has been arrested on suspicion of authoring the Slapper worm. But although the threat of the worm seems to have been short-lived, a new variant is already set to take up where its predecessor left off. Although the ISC's 'most attacked ports' chart no longer features Slapper in its Top 10 a variant, Slapper.B, has been spotted in the wild. Slapper.B has several subtle differences, but is for the most part an updated version of its predecessor. Both worms attempt to exploit a known vulnerability in the Secure Sockets Layer 2.0 (SSLv2) handshake process. The two variants also carry the same payload, a password-protected backdoor and denial of service (DoS) capabilities. ISS's Morgan said that with the new variant on the loose his company had calculated that about 10,000 servers were probably now infected, and that the network was probably going to be used for DoS attacks. He added that it was unlikely the original author created the second worm. "It was significant that source code for the original Slapper was distributed within the computer underground immediately after the worm was detected in the wild," he said. Source: http://www.vnunet.com/News/1135274 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "Cutting the space budget really restores my faith in humanity. It eliminates dreams, goals, and ideals and lets us get straight to the business of hate, debauchery, and self-annihilation." -- Johnny Hart ***testing, only testing, and damn good at it too!*** OK, so you're a Ph.D. Just don't touch anything. ----- End forwarded message ----- --=20 ---- WBR, Michael Shigorin ------ Linux.Kiev http://www.linux.kiev.ua/ --WYTEVAkct0FjGQmd Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (FreeBSD) iD8DBQE9kIQabsPDprYMm3IRAg5YAJ9oTE6mrl0uKScPTD8SIbFcWYbGbQCfa/kQ 4S3Uq7K5H+xxqWVG/lOpO9o= =d+Gd -----END PGP SIGNATURE----- --WYTEVAkct0FjGQmd--