From: David Weinehall <tao@acc.umu.se>
To: kernel@ddx.a2000.nu
Cc: Guest section DW <dwguest@win.tue.nl>,
Alan Cox <alan@lxorguk.ukuu.org.uk>,
linux-kernel@vger.kernel.org, Enforcer <enforcer@ddx.a2000.nu>
Subject: Re: Strange errors in /var/log/messages
Date: Tue, 3 Jul 2001 09:45:34 +0200 [thread overview]
Message-ID: <20010703094534.A27854@khan.acc.umu.se> (raw)
In-Reply-To: <20010702194212.A400@win.tue.nl> <Pine.LNX.4.30.0107022133380.6699-100000@ddx.a2000.nu>
In-Reply-To: <Pine.LNX.4.30.0107022133380.6699-100000@ddx.a2000.nu>; from kernel@ddx.a2000.nu on Mon, Jul 02, 2001 at 09:51:44PM +0200
On Mon, Jul 02, 2001 at 09:51:44PM +0200, kernel@ddx.a2000.nu wrote:
> On Mon, 2 Jul 2001, Guest section DW wrote:
>
> > On Mon, Jul 02, 2001 at 05:16:23PM +0100, Alan Cox wrote:
> >
> > > > I'm running RedHat 7.0 with all official RH patches applied. The kernel I
> > > > currently run fow a few days is 2.2.19-7.0.8
> > > > I run the pre-compiled kernel of RH. Suddenly I the following messages:
> > > >
> > > > Jul 2 15:12:16 gateway SERVER[1240]: Dispatch_input: bad request line
> > > > 'BBXXXXXXXXXXXXXXXXXX%.176u%3
> > > > 00$nsecurity.%301$n%302$n%.192u%303$n\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\22
> >
> > > These are for an application. Not sure which or why
> >
> > See CERT Advisory CA-2000-22
> > http://www.infowar.com/iwftp/cert/advisories/CA-2000-22.html
> >
> > "A popular replacement software package to the BSD lpd printing service
> > called LPRng contains at least one software defect, known as a "format string
> > vulnerability," which may allow remote users to execute arbitrary code on
> > vulnerable systems."
>
> I just read the article. It seems somebody tried to exploid a bug in
> LPRng. Unfortunately I didn't check the TCP/IP connections at the time of
> attack (with netstat), so I couldn't tell who was connected to port 515.
> The article suggest upgrading to 3.6.25. I'm currenlty running 3.7.4-23.
> I assume I'm not vulnerable, but those 'errors' in the logfile really
> scared the heck out of me! :) To be certain, I just blocked poort 515 for
> outbound connections. :)
>
> Bye the way, sorry this message was off-topic, but I didn't know it was a
> LPRng issue, not a kernel issue.
A good idea is to block all ports, then open only those you know needs to
be open. Paranoia is good.
/David
_ _
// David Weinehall <tao@acc.umu.se> /> Northern lights wander \\
// Project MCA Linux hacker // Dance across the winter sky //
\> http://www.acc.umu.se/~tao/ </ Full colour fire </
next prev parent reply other threads:[~2001-07-03 7:46 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2001-07-02 16:05 kernel
2001-07-02 16:11 ` Remco B. Brink
2001-07-02 16:16 ` Alan Cox
2001-07-02 17:42 ` Guest section DW
2001-07-02 19:51 ` kernel
2001-07-03 7:45 ` David Weinehall [this message]
2001-07-02 17:00 ` Richard B. Johnson
2001-07-02 18:23 ` [OT] " Ville Herva
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20010703094534.A27854@khan.acc.umu.se \
--to=tao@acc.umu.se \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=dwguest@win.tue.nl \
--cc=enforcer@ddx.a2000.nu \
--cc=kernel@ddx.a2000.nu \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®