One thing I am desperately curious about...the four IP addresses listed in the anonymously-provided information. I'm wondering if it's the same four or if someone has a distributed network in place for the purpose of building other distributed networks. Also, how closely-tied are the four events in terms of time... > As was noted earlier the Cark DDoS agent is spreading via snmpXdmid: > > Solaris snmpXdmid Buffer Overflow Vulnerability > http://www.securityfocus.com/bid/2417 > > So obviously, there is an exploit in the wild for the this and it's > getting a fair bit of play - does anyone have a packet capture if this in > action or perhaps an actual exploit?
This archive was generated by hypermail 2b30 : Wed Apr 18 2001 - 09:18:13 PDT