From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S263760AbTDHBVp (for ); Mon, 7 Apr 2003 21:21:45 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S263761AbTDHBVo (for ); Mon, 7 Apr 2003 21:21:44 -0400 Received: from isis.telemach.net ([213.143.65.10]:60165 "HELO isis.telemach.net") by vger.kernel.org with SMTP id S263760AbTDHBVo (for ); Mon, 7 Apr 2003 21:21:44 -0400 Date: Tue, 8 Apr 2003 03:33:15 +0200 From: Jure Pecar To: linux-kernel@vger.kernel.org Subject: some new remote kernel exploit? Message-Id: <20030408033315.42f407ec.pegasus@nerv.eu.org> Organization: Select Technology X-Mailer: Sylpheed version 0.8.11 (GTK+ 1.2.10; i386-redhat-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Hi all, Please see my post to the redhat list at https://listman.redhat.com/pipermail/valhalla-list/2003-April/025830.html I'm getting more and more affraid ... since now the the third box was targeted and there were more attempts at 22:00-22:47 localtime (gmt+1). rpm -Va shows nothing suspicious, so i hope these are still only attempts. I have put the ksymoops from the logs at http://nerv.eu.org/oopsen/ if you want to see them all. I'm pretty much without ideas how to track this down ... expect to sit at the computer for the next 24h and be ready to start dumping traffic at the moment it starts again. Please cc me on replies. Thanks. -- Jure Pecar