Re: more named warez

From: Gus (angusat_private)
Date: Sun Jun 14 1998 - 15:53:41 PDT

  • Next message: tqbfat_private: "Re: Vulnerability in 4.4BSD Secure Levels Implementation" 

    This was mostly for my own amusement, since I am always interested in
/who/ is trying to 0wn my boxen, as well as preventing it.

When an exploit attempt is recieved, you get:
Jun 14 23:45:47 victim named[2670]: IQUERY recieved from [192.168.0.20].27447

The patch is for 4.9.6-REL, but it should work accross the board, you get
the idea, anyways.

named may be (is?) the new imapd, with all the bulk scanning that that
implies. You all know the score.



*** ns_req.c    Tue Apr  7 05:59:46 1998
--- ns_req.c.new        Thu Jun  4 13:54:07 1998
***************
*** 193,199 ****
                break;

        case IQUERY:
!               action = req_iquery(hp, &cp, eom, &buflen, msg, from);
                break;

  #ifdef BIND_NOTIFY
--- 193,201 ----
                break;

        case IQUERY:
!               hp->rcode = REFUSED;
!               action = Finish;
!               syslog(LOG_ALERT,"IQUERY recieved from %s",sin_ntoa(from));
                break;

  #ifdef BIND_NOTIFY





--
                                angusat_private

    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:57:55 PDT