From owner-freebsd-hackers  Wed Jun  6 21:50:29 2001
Delivered-To: freebsd-hackers@freebsd.org
Received: from tomts13-srv.bellnexxia.net (tomts13.bellnexxia.net [209.226.175.34])
	by hub.freebsd.org (Postfix) with ESMTP id 62F3337B414
	for <freebsd-hackers@FreeBSD.ORG>; Wed,  6 Jun 2001 21:50:26 -0700 (PDT)
	(envelope-from matt@xena.gsicomp.on.ca)
Received: from xena.gsicomp.on.ca ([64.228.152.235])
          by tomts13-srv.bellnexxia.net
          (InterMail vM.4.01.03.16 201-229-121-116-20010115) with ESMTP
          id <20010607045025.KZYQ6458.tomts13-srv.bellnexxia.net@xena.gsicomp.on.ca>;
          Thu, 7 Jun 2001 00:50:25 -0400
Received: from localhost (matt@localhost)
	by xena.gsicomp.on.ca (8.11.1/8.11.1) with ESMTP id f574lmp35080;
	Thu, 7 Jun 2001 00:47:49 -0400 (EDT)
	(envelope-from matt@xena.gsicomp.on.ca)
Date: Thu, 7 Jun 2001 00:47:48 -0400 (EDT)
From: Matthew Emmerton <matt@xena.gsicomp.on.ca>
To: Dan Phoenix <dphoenix@bravenet.com>
Cc: freebsd-hackers@FreeBSD.ORG
Subject: Re: rpc.statd
In-Reply-To: <Pine.BSO.4.21.0106062138170.27575-100000@gandalf.bravenet.com>
Message-ID: <Pine.BSF.4.21.0106070046050.35075-100000@xena.gsicomp.on.ca>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-hackers@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-hackers.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-hackers>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-hackers>
X-Loop: FreeBSD.ORG

On Wed, 6 Jun 2001, Dan Phoenix wrote:

> 
> Jun  6 18:48:10 www rpc.statd: invalid hostname to
> sm_stat: ^X<F7><FF><BF>^X<F7><FF><BF>^Z<F7><FF>
> <BF>^Z<F7><FF><BF>%8x%8x%8x%8x%8x%8x%8x%8x%8x%62716x%hn%51859x%hnM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-

[ snip ]

It's some l33t h4x0r attemting to use a Linux RPC exploit against your
FreeBSD machine.  From what I've been told, It's harmless (since FreeBSD
never had the hole that Linux did), and I see it quite often on some of
the public boxes that I run.

Are you absolutely sure that this was the cause of your kernel panic?

--
Matt Emmerton
GSI Computer Services


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message