From: aen <aen@altlinux.ru>
To: community@altlinux.ru
Subject: [Comm] [Fwd: [sisyphus] Fw: Re: Heads up... Possible worm on the loose...]
Date: Thu, 10 Apr 2003 21:18:21 +0400
Message-ID: <3E95A75D.9030906@altlinux.ru> (raw)
[-- Attachment #1: Type: text/plain, Size: 48 bytes --]
Напоминаю, что наши updates уже давно выложены.
[-- Attachment #2: [sisyphus] Fw: Re: Heads up... Possible worm on the loose... --]
[-- Type: message/rfc822, Size: 5747 bytes --]
[-- Attachment #2.1.1: Type: text/plain, Size: 2897 bytes --]
Внимание, Червь на базе последней уязвимости для Samba 2.0 и 2.2 уже
путешествует и заражает. Рекомендую проинформировать своих администраторов
и пользователей о необходимости немедленного обновления. В случае
заражения деактивация червя возможна посредством утилиты, описанной внизу
письма.
2ldv: Надо бы в security-announce отправить...
----- Forwarded message from Jelmer Vernooij -----
Date: Thu, 10 Apr 2003 18:36:31 +0200
From: Jelmer Vernooij
To: Michael H. Warfield
Subject: Re: Heads up... Possible worm on the loose...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Thursday 10 April 2003 18:27, Michael H. Warfield wrote:
> This is just a heads up in case any of you start fielding
> questions about a Samba worm.
>
> We've got some reports from some universities of a "Samba worm"
> running loose and infecting systems with the SuckIT rootkit. Primary
> target is Linux x86. BSD systems in the same environment are not being
> compromised.
>
> The presumption is that this is based on the recent trans2
> vulnerabiltity and I have some reports indicating a spike in port 139
> scanning just after the 4th that may be related.
>
> This, right here, is my worst fear with a 0day being posted,
> even when there is an exploit in circulation. Someone can immediately
> take the 0day and load in into the warhead of a worm and turn it loose.
> With indeterminant exploits in the wild or with "proof of concept" code,
> they still have to WORK at it to find it or make it work. This makes
> it too damn easy and cuts the deployment latency window to zilch. /:-|=|
>
> At this time, we have copies of the rootkit know what it is.
> We also have indications that the payload (the worm egg w/ rootkit)
> was being downloaded from a specific central site which is under
> investigation right now. We don't have copies of the "dropper" (the
> worm head) nor have I received any logs yet to confirm what exploit
> what used.
>
> I'll post more information as I learn it. I just figured some
> of you might hear something from other sources and could use the
> information.
Quite some hosts at the University of Twente here in Holland have been
infected (they use SMB and an web-based index program to share files
over the campus). Here is some more info:
http://hysteria.sk/sd/f/suckit/readme
The worm can be disabled using:
/usr/share/locale/sk/.sx12/sk u
More (Dutch) info on http://www.snt.utwente.nl/actueel/news.php?id=69
Jelmer
- --
Jelmer Vernooij <jelmer@nl.linux.org> - http://nl.linux.org/~jelmer/
18:31:15 up 22:06, 7 users, load average: 0.19, 0.31, 0.80
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE+lZ2PPa9Uoh7vUnYRApS4AJ4hYCrhHXQKtsqlrH5G7vMs9Mj9TQCghQzS
HkfxreYTaI92p3MiL8Stf6w=
=6siE
-----END PGP SIGNATURE-----
----- End forwarded message -----
--
/ Alexander Bokovoy
---
egrep -n '^[a-z].*\(' $ | sort -t':' +2.0
[-- Attachment #2.1.2: Type: application/pgp-signature, Size: 189 bytes --]
next reply other threads:[~2003-04-10 17:18 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-04-10 17:18 aen [this message]
2003-04-10 16:57 ` Korshunov Ilya
2003-04-10 16:59 ` Alexander Bokovoy
2003-04-10 17:14 ` Korshunov Ilya
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3E95A75D.9030906@altlinux.ru \
--to=aen@altlinux.ru \
--cc=community@altlinux.ru \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
ALT Linux Community general discussions
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://lore.altlinux.org/community/0 community/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 community community/ http://lore.altlinux.org/community \
mandrake-russian@linuxteam.iplabs.ru community@lists.altlinux.org community@lists.altlinux.ru community@lists.altlinux.com
public-inbox-index community
Example config snippet for mirrors.
Newsgroup available over NNTP:
nntp://lore.altlinux.org/org.altlinux.lists.community
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git