From owner-freebsd-questions  Mon Jan 29  1:49: 1 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from obsecurity.org (adsl-64-169-104-72.dsl.lsan03.pacbell.net [64.169.104.72])
	by hub.freebsd.org (Postfix) with ESMTP id EFE6037B6A0
	for <freebsd-questions@FreeBSD.ORG>; Mon, 29 Jan 2001 01:48:43 -0800 (PST)
Received: by obsecurity.org (Postfix, from userid 1000)
	id C9122BA2AF; Mon, 29 Jan 2001 01:49:13 -0800 (PST)
Date: Mon, 29 Jan 2001 01:49:13 -0800
From: Kris Kennaway <kris@obsecurity.org>
To: Ryan Thompson <ryan@sasknow.com>
Cc: freebsd-questions@FreeBSD.ORG
Subject: Re: rpc.statd funniness
Message-ID: <20010129014913.A23112@xor.obsecurity.org>
References: <Pine.BSF.4.21.0101290131330.61699-100000@ren.sasknow.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="x+6KMIRAuhnl3hBn"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <Pine.BSF.4.21.0101290131330.61699-100000@ren.sasknow.com>; from ryan@sasknow.com on Mon, Jan 29, 2001 at 01:42:12AM -0600
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG


--x+6KMIRAuhnl3hBn
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Jan 29, 2001 at 01:42:12AM -0600, Ryan Thompson wrote:
>=20
> I noticed several weird lines in /var/messages a little over an hour ago:
>=20
> Jan 29 00:33:18 ren rpc.statd: invalid hostname to sm_stat: ^Xw^??^Xw^??^=
Yw^??^Yw^??^Zw^??^Zw^??^[w^??^[w^??%8x%8x%8x%8x%8x%8x%8x%8x%8x%236x%n%137x%=
n%10x%n%192x%n^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^=
P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P=
^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^=
P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P=
^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^=
P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P=
^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^=
P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P=
^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^=
P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P=
^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^=
P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P^P

Script kiddies trying a Linux buffer overflow. FreeBSD isn't
vulnerable.

Kris

--x+6KMIRAuhnl3hBn
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE6dTyZWry0BWjoQKURAo87AJ0RFV4a84SzQTXuSjPofboAq2hFwACghCCr
V+mYeXBlmiL3ynMK9G7/cok=
=1+gK
-----END PGP SIGNATURE-----

--x+6KMIRAuhnl3hBn--


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message