From owner-freebsd-isp  Mon Nov 26 18:14:23 2001
Delivered-To: freebsd-isp@freebsd.org
Received: from mail1.tor.primus.ca (mail.tor.primus.ca [216.254.136.21])
	by hub.freebsd.org (Postfix) with ESMTP id 5C60837B41A
	for <freebsd-isp@freebsd.org>; Mon, 26 Nov 2001 18:14:20 -0800 (PST)
Received: from dialin-135-109.hamilton.primus.ca ([209.90.135.109])
	by mail1.tor.primus.ca with esmtp (Exim 2.11 #1)
	id 168Xnh-0001Zd-05; Mon, 26 Nov 2001 21:16:46 -0500
Date: Mon, 26 Nov 2001 21:14:23 -0500 (EST)
From: Jason Hunt <leth@primus.ca>
X-X-Sender: leth@lethargic.dyndns.org
To: Blake Swensen <blake@pyramus.com>
Cc: freebsd-isp@FreeBSD.ORG
Subject: Re: Whaaa?  /var/log/messages weirdness?
In-Reply-To: <3C02F13D.AA1D7ABC@pyramus.com>
Message-ID: <Pine.BSF.4.40.0111262113170.508-100000@lethargic.dyndns.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=X-UNKNOWN
Content-Transfer-Encoding: QUOTED-PRINTABLE
Sender: owner-freebsd-isp@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-isp.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-isp>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-isp>
X-Loop: FreeBSD.org

I belive that is an rpc exploit, that was patched a while ago, however I
am not sure of any details.

On Mon, 26 Nov 2001, Blake Swensen wrote:

> This appeared in /var/log/messages on one of my machines.... anyone seen
> this before?
>
> Nov 26 01:58:22 myhost rpc.statd: invalid hostname to sm_stat:
> ^X=F7=FF=BF^X=F7=FF=BF^Y=F7=FF=BF^Y=F7=FF=BF^Z=F7=FF=BF^Z=F7=FF=BF^[=F7=
=FF=BF^[=F7=FF=BF%8x%8x%8x%8x%8x%8x%8x%8x%8x%236x%n%137x%n%10x%n%192x%nM-^P=
M-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^=
PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-=
^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM=
-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^P=
M-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^=
PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-=
^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM=
-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^P=
M-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^=
PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-=
^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM=
-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^P
>
> This immediately followed a NIS server coming back to life... but I
> thought I would ask to make sure that there is not a hack going on here.
>
> Peace,
> Blake
>


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-isp" in the body of the message