* [Comm] [Fwd: [sisyphus] Fw: Re: Heads up... Possible worm on the loose...]
@ 2003-04-10 17:18 aen
2003-04-10 16:57 ` Korshunov Ilya
0 siblings, 1 reply; 4+ messages in thread
From: aen @ 2003-04-10 17:18 UTC (permalink / raw)
To: community
[-- Attachment #1: Type: text/plain, Size: 48 bytes --]
Напоминаю, что наши updates уже давно выложены.
[-- Attachment #2: [sisyphus] Fw: Re: Heads up... Possible worm on the loose... --]
[-- Type: message/rfc822, Size: 5747 bytes --]
[-- Attachment #2.1.1: Type: text/plain, Size: 2897 bytes --]
Внимание, Червь на базе последней уязвимости для Samba 2.0 и 2.2 уже
путешествует и заражает. Рекомендую проинформировать своих администраторов
и пользователей о необходимости немедленного обновления. В случае
заражения деактивация червя возможна посредством утилиты, описанной внизу
письма.
2ldv: Надо бы в security-announce отправить...
----- Forwarded message from Jelmer Vernooij -----
Date: Thu, 10 Apr 2003 18:36:31 +0200
From: Jelmer Vernooij
To: Michael H. Warfield
Subject: Re: Heads up... Possible worm on the loose...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Thursday 10 April 2003 18:27, Michael H. Warfield wrote:
> This is just a heads up in case any of you start fielding
> questions about a Samba worm.
>
> We've got some reports from some universities of a "Samba worm"
> running loose and infecting systems with the SuckIT rootkit. Primary
> target is Linux x86. BSD systems in the same environment are not being
> compromised.
>
> The presumption is that this is based on the recent trans2
> vulnerabiltity and I have some reports indicating a spike in port 139
> scanning just after the 4th that may be related.
>
> This, right here, is my worst fear with a 0day being posted,
> even when there is an exploit in circulation. Someone can immediately
> take the 0day and load in into the warhead of a worm and turn it loose.
> With indeterminant exploits in the wild or with "proof of concept" code,
> they still have to WORK at it to find it or make it work. This makes
> it too damn easy and cuts the deployment latency window to zilch. /:-|=|
>
> At this time, we have copies of the rootkit know what it is.
> We also have indications that the payload (the worm egg w/ rootkit)
> was being downloaded from a specific central site which is under
> investigation right now. We don't have copies of the "dropper" (the
> worm head) nor have I received any logs yet to confirm what exploit
> what used.
>
> I'll post more information as I learn it. I just figured some
> of you might hear something from other sources and could use the
> information.
Quite some hosts at the University of Twente here in Holland have been
infected (they use SMB and an web-based index program to share files
over the campus). Here is some more info:
http://hysteria.sk/sd/f/suckit/readme
The worm can be disabled using:
/usr/share/locale/sk/.sx12/sk u
More (Dutch) info on http://www.snt.utwente.nl/actueel/news.php?id=69
Jelmer
- --
Jelmer Vernooij <jelmer@nl.linux.org> - http://nl.linux.org/~jelmer/
18:31:15 up 22:06, 7 users, load average: 0.19, 0.31, 0.80
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE+lZ2PPa9Uoh7vUnYRApS4AJ4hYCrhHXQKtsqlrH5G7vMs9Mj9TQCghQzS
HkfxreYTaI92p3MiL8Stf6w=
=6siE
-----END PGP SIGNATURE-----
----- End forwarded message -----
--
/ Alexander Bokovoy
---
egrep -n '^[a-z].*\(' $ | sort -t':' +2.0
[-- Attachment #2.1.2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Comm] [Fwd: [sisyphus] Fw: Re: Heads up... Possible worm on the loose...]
2003-04-10 17:18 [Comm] [Fwd: [sisyphus] Fw: Re: Heads up... Possible worm on the loose...] aen
@ 2003-04-10 16:57 ` Korshunov Ilya
2003-04-10 16:59 ` Alexander Bokovoy
0 siblings, 1 reply; 4+ messages in thread
From: Korshunov Ilya @ 2003-04-10 16:57 UTC (permalink / raw)
To: community
[-- Attachment #1: signed data --]
[-- Type: text/plain, Size: 459 bytes --]
В сообщении от Четверг 10 Апрель 2003 21:18 aen написал(a):
> Внимание, Червь на базе последней уязвимости для Samba 2.0 и 2.2 уже
> путешествует и заражает. Рекомендую проинформировать своих администраторов
> и пользователей о необходимости немедленного обновления. В случае
> заражения деактивация червя возможна посредством утилиты, описанной внизу
> письма.
А как он размножается то ??....или у всех smb в инет смотрит ??
--
Best Regards
Korshunov Ilya
[-- Attachment #2: signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Comm] [Fwd: [sisyphus] Fw: Re: Heads up... Possible worm on the loose...]
2003-04-10 16:57 ` Korshunov Ilya
@ 2003-04-10 16:59 ` Alexander Bokovoy
2003-04-10 17:14 ` Korshunov Ilya
0 siblings, 1 reply; 4+ messages in thread
From: Alexander Bokovoy @ 2003-04-10 16:59 UTC (permalink / raw)
To: community
On Thu, Apr 10, 2003 at 08:57:57PM +0400, Korshunov Ilya wrote:
Content-Description: signed data
> В сообщении от Четверг 10 Апрель 2003 21:18 aen написал(a):
> > Внимание, Червь на базе последней уязвимости для Samba 2.0 и 2.2 уже
> > путешествует и заражает. Рекомендую проинформировать своих администраторов
> > и пользователей о необходимости немедленного обновления. В случае
> > заражения деактивация червя возможна посредством утилиты, описанной внизу
> > письма.
>
> А как он размножается то ??....или у всех smb в инет смотрит ??
В основном он размножается в местах с большим скоплением Linux-компьютеров
-- университеты, исследовательские центры и т.д.
Недоброжелателей в любой сети хватает.
--
/ Alexander Bokovoy
---
Diplomacy is the art of letting the other party have things your way.
-- Daniele Vare
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2003-04-10 17:18 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2003-04-10 17:18 [Comm] [Fwd: [sisyphus] Fw: Re: Heads up... Possible worm on the loose...] aen
2003-04-10 16:57 ` Korshunov Ilya
2003-04-10 16:59 ` Alexander Bokovoy
2003-04-10 17:14 ` Korshunov Ilya
ALT Linux Community general discussions
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://lore.altlinux.org/community/0 community/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 community community/ http://lore.altlinux.org/community \
mandrake-russian@linuxteam.iplabs.ru community@lists.altlinux.org community@lists.altlinux.ru community@lists.altlinux.com
public-inbox-index community
Example config snippet for mirrors.
Newsgroup available over NNTP:
nntp://lore.altlinux.org/org.altlinux.lists.community
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git