Re: New script-kiddie looking scan

From: Chris Ess (azarinat_private)
Date: Tue Jun 18 2002 - 16:27:04 PDT

  • Next message: Alain Fauconnet: "Re: New script-kiddie looking scan"

    > > WinAmp leaves me baffled. Maybe someone can answer that part of the
    > > equation.
    >
    > Often people with cable or dsl download a lot of mp3's because the bandwith is available.
    > Perhaps also waiting for a winamp hole to surface for use with ddos nets? Perhaps one
    > already exists which isn't known?
    
    The problem is that Winamp doesn't listen on 8000 normally -- at least in
    my experience.  Shoutcast servers (used for streaming mp3s for such things
    as Internet 'radio stations') listen on ports 8000 to 8002.  At the
    beginning of this month, a remote buffer overflow vulernability was
    announced for Shoutcast 1.8.9.  The link is below:
    
    http://online.securityfocus.com/bid/4934
    
    
    Also, I have seen several proxies use port 8000 instead of 8080, so that
    may be what the parties responsible are looking for.
    
    Hope this helps.
    
    Sincerely,
    
    Christopher Ess
    System Administrator / CDTT (Certified Duct Tape Technician)
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Jun 18 2002 - 22:17:17 PDT