From owner-freebsd-security  Thu Mar  8  6:11:26 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ohm.physics.purdue.edu (ohm.physics.purdue.edu [128.210.146.32])
	by hub.freebsd.org (Postfix) with ESMTP id 7E7CA37B719
	for <freebsd-security@FreeBSD.ORG>; Thu,  8 Mar 2001 06:11:23 -0800 (PST)
	(envelope-from will@physics.purdue.edu)
Received: (from will@localhost)
	by ohm.physics.purdue.edu (8.11.2/8.9.3) id f28ED3g47884;
	Thu, 8 Mar 2001 09:13:03 -0500 (EST)
	(envelope-from will@physics.purdue.edu)
X-Authentication-Warning: ohm.physics.purdue.edu: will set sender to will@physics.purdue.edu using -f
Date: Thu, 8 Mar 2001 09:13:03 -0500
From: Will Andrews <will@physics.purdue.edu>
To: Will Mitayai Keeso Rowe <mitayai@dreaming.org>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: strange messages
Message-ID: <20010308091303.I45561@ohm.physics.purdue.edu>
Reply-To: Will Andrews <will@physics.purdue.edu>
References: <Pine.BSF.4.32.0103080903370.79839-100000@castle.dreaming.org>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="vs0rQTeTompTJjtd"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <Pine.BSF.4.32.0103080903370.79839-100000@castle.dreaming.org>; from mitayai@dreaming.org on Thu, Mar 08, 2001 at 09:08:25AM -0500
X-Operating-System: FreeBSD 4.2-STABLE i386
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


--vs0rQTeTompTJjtd
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Mar 08, 2001 at 09:08:25AM -0500, Will Mitayai Keeso Rowe wrote:
> Mar  7 00:07:55 machine rpc.statd: invalid hostname to sm_stat: ^X=F7=FF=
=BF^X=F7=FF=BF^Y=F7=FF=BF^Y=F7=FF=BF^Z=F7=FF=BF^Z=F7=FF=BF^[=F7=FF=BF^[=F7=
=FF=BF%8x%8x%8x%8x%8x%8x%8x%8x%8x%236x%n%137x%n%10x%n%192x%nM-^PM-^PM-^PM-^=
PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-=
^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM=
-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^P=
M-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^=
PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-=
^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM=
-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^P=
M-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^=
PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-=
^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM=
-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^!
>  PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^P
> Mar  7 00:07:55 machine /kernel: -^PM-^PM-^P

Linux script kiddie running a Linux rpc.statd exploit on your box that
(surprise!) doesn't work on FreeBSD.  :-)

--=20
wca

--vs0rQTeTompTJjtd
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.3 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE6p5NsF47idPgWcsURAu+bAJ9ZP2wMUuxPhB7H7I+zgAkGPiMxBACfRaQ5
S6VkKySzwaiRa0ayGFw7YIs=
=VB1+
-----END PGP SIGNATURE-----

--vs0rQTeTompTJjtd--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message