From owner-freebsd-questions  Sun Sep  9 15: 6:20 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from obsecurity.dyndns.org (adsl-63-207-60-54.dsl.lsan03.pacbell.net [63.207.60.54])
	by hub.freebsd.org (Postfix) with ESMTP id 70B0A37B432
	for <questions@FreeBSD.ORG>; Sun,  9 Sep 2001 15:06:11 -0700 (PDT)
Received: by obsecurity.dyndns.org (Postfix, from userid 1000)
	id 4FEA266C7A; Sun,  9 Sep 2001 15:06:11 -0700 (PDT)
Date: Sun, 9 Sep 2001 15:06:11 -0700
From: Kris Kennaway <kris@obsecurity.org>
To: jack chen <chenjun@hefei.cngb.com>
Cc: questions@FreeBSD.ORG
Subject: Re: May you give me answer?
Message-ID: <20010909150611.B5505@xor.obsecurity.org>
References: <3B9B5FE6.C74D01FE@hefei.cngb.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="mojUlQ0s9EVzWg2t"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <3B9B5FE6.C74D01FE@hefei.cngb.com>; from chenjun@hefei.cngb.com on Sun, Sep 09, 2001 at 08:26:15PM +0800
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG


--mojUlQ0s9EVzWg2t
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Sep 09, 2001 at 08:26:15PM +0800, jack chen wrote:
> Hi there:
>=20
>     Recently my server installed FreeBSD released 4.2 often forbidden to
> telnet and inetd proccess was shut down.
>=20
> Then i  read messages  log and found indication:"Sep  8 08:39:17 fh666
> /kernel: pid 179 (inetd), uid 0: exited on signal 11 (core dumped)".
>=20
> Why is it? May you tell me how to resolve it ?
>=20
> Need you help.

telnetd has a serious security hole which allows remote attackers to
take over your system.  This is probably what has happened.

See the security advisory on the FreeBSD website.  You need to wipe
your system completely and reinstall it to make sure the attackers
haven't left behind one or more "backdoors" which will allow them to
get back in.

Kris

--mojUlQ0s9EVzWg2t
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE7m+fSWry0BWjoQKURAr7RAJ49Pz89+Mafs2bgKUFMInJmofuDIwCgjsVW
KVNNaocwp215Ffv5m6QET2w=
=vFFK
-----END PGP SIGNATURE-----

--mojUlQ0s9EVzWg2t--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message