From owner-freebsd-security Thu Aug 23 3:50:16 2001 Delivered-To: freebsd-security@freebsd.org Received: from obsecurity.dyndns.org (adsl-63-207-60-54.dsl.lsan03.pacbell.net [63.207.60.54]) by hub.freebsd.org (Postfix) with ESMTP id AA90337B40B for ; Thu, 23 Aug 2001 03:50:12 -0700 (PDT) (envelope-from kris@obsecurity.org) Received: by obsecurity.dyndns.org (Postfix, from userid 1000) id 57FE666D1C; Thu, 23 Aug 2001 03:50:09 -0700 (PDT) Date: Thu, 23 Aug 2001 03:50:08 -0700 From: Kris Kennaway To: Mark Newton Cc: freebsd-security@FreeBSD.ORG Subject: Re: Attempts to overflow rpc.statd Message-ID: <20010823035008.A96330@xor.obsecurity.org> References: <20010823195855.A77982@atdot.dotat.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="y0ulUmNC+osPPQO6" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <20010823195855.A77982@atdot.dotat.org>; from newton@atdot.dotat.org on Thu, Aug 23, 2001 at 07:58:55PM +0930 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org --y0ulUmNC+osPPQO6 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Aug 23, 2001 at 07:58:55PM +0930, Mark Newton wrote: > I've been seeing these in syslog for the last week or so. Has anyone > else run across them? >=20 > It looks like a buffer overflow attempt on rpc.statd, but since there > aren't any FreeBSD advisories about it I'm guessing that the script > kiddies are hitting on it at random without necessarily knowing about > what kind of architecture or OS they're trying to attack. >=20 > Does it look familiar to anyone else? Yes, it's an old Linux vulnerability. Kris --y0ulUmNC+osPPQO6 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE7hN/fWry0BWjoQKURAkgZAJ9M3x8qMFDiUNuPvT+4QMX/zmF3ngCgv8lx 4mr7w2tAUn4uhJfZaCYzkW0= =lPH+ -----END PGP SIGNATURE----- --y0ulUmNC+osPPQO6-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message