Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 20 Apr 2001 14:37:35 -0700
From:      Josef Grosch <jgrosch@mooseriver.com>
To:        =?iso-8859-1?Q?P=E4r_Thoren?= <t98pth@student.bth.se>
Cc:        freebsd-security@FreeBSD.ORG
Subject:   Re: rpc.statd attack
Message-ID:  <20010420143734.A79887@mooseriver.com>
In-Reply-To: <Pine.GSO.4.21.0104202315040.27489-100000@helios>; from t98pth@student.bth.se on Fri, Apr 20, 2001 at 11:17:55PM %2B0200
References:  <Pine.GSO.4.21.0104202315040.27489-100000@helios>

next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Apr 20, 2001 at 11:17:55PM +0200, Pär Thoren wrote:
> 
> Ok when I get portscanned...but these guys tries to exploit my ass.
> 
> Apr 20 23:09:05 z rpc.statd: invalid hostname to
> sm_stat: ^X÷ÿ¿^X÷ÿ¿^Y÷ÿ¿^Y÷ÿ¿^Z÷ÿ¿^Z÷ÿ¿^[÷ÿ¿^[÷ÿ¿%8x%8x%8x%8x%8x%8x%8x%8x%8x%236x%n%137x%n%10x%n%192x%nM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^P
> 
> I guess it´s the old linux rpc.statd epxloit. But how can I see what IP
> did this? Does rpc.statd log this information by default?
> 
> /Pär


Ya,

I saw a couple of these in my log files last night. I also would like to
find out what the IP of these bozos is. I'd like to let their ISP know that
these guys need to be spank pretty hard.

One should check to see if rpc.statd is turned off in /etc/inetd.conf.


Josef

-- 
Josef Grosch           | Another day closer to a | FreeBSD 4.3
jgrosch@MooseRiver.com |   Micro$oft free world  | www.bafug.org


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010420143734.A79887>