[prj at NLS.NET: CERT Summary CS-98.05 (fwd)]
ma06205 at cc.uoi.gr
ma06205 at cc.uoi.gr
Fri May 29 12:47:28 EEST 1998
----- Forwarded message from "Phillip R. Jaenke" <prj at NLS.NET> -----
Received: from brimstone.netspace.org (brimstone.netspace.org [128.148.157.143]) by cc.uoi.gr (8.8.4/8.8.3) with ESMTP id IAA12317 for <ma06205 at CC.UOI.GR>; Fri, 29 May 1998 08:44:54 +0300 (EET DST)
Received: from unknown at netspace.org (port 54076 [128.148.157.6]) by brimstone.netspace.org with ESMTP id <1768-8871>; Fri, 29 May 1998 01:36:57 -0400
Received: from NETSPACE.ORG by NETSPACE.ORG (LISTSERV-TCP/IP release 1.8c) with
spool id 1128214 for BUGTRAQ at NETSPACE.ORG; Fri, 29 May 1998 01:31:25
-0400
Received: from brimstone.netspace.org (brimstone.netspace.org
[128.148.157.143]) by netspace.org (8.8.7/8.8.7) with ESMTP id
BAA24802 for <BUGTRAQ at NETSPACE.ORG>; Fri, 29 May 1998 01:30:36 -0400
Received: from unknown at netspace.org (port 54076 [128.148.157.6]) by
brimstone.netspace.org with ESMTP id <1644-8871>; Fri, 29 May 1998
01:30:54 -0400
Approved-By: aleph1 at NATIONWIDE.NET
Received: from ns2.nls.net (ns2.nls.net [207.206.21.11]) by netspace.org
(8.8.7/8.8.7) with SMTP id XAA10009 for <bugtraq at netspace.org>; Thu,
28 May 1998 23:03:45 -0400
Received: from [207.206.37.251] by ns2.nls.net (NTMail 3.03.0017/1.ar51) with
ESMTP id ca299574 for <bugtraq at netspace.org>; Thu, 28 May 1998
23:04:09 -0400
X-Sender: prj at eiterra
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-ID: <Pine.LNX.3.96.980528230438.3104A-100000 at eiterra>
Date: Thu, 28 May 1998 23:04:50 -0400
Reply-To: "Phillip R. Jaenke" <prj at NLS.NET>
Sender: Bugtraq List <BUGTRAQ at NETSPACE.ORG>
From: "Phillip R. Jaenke" <prj at NLS.NET>
Subject: CERT Summary CS-98.05 (fwd)
To: BUGTRAQ at NETSPACE.ORG
Content-Length: 8289
Status: O
Fresh off the CERT presses. Whee.
--Phillip R. Jaenke (prj at nls.net - InterNIC: PRJ5)
Head Geek, Linux at Comdex Project - http://comdex.linuxos.org/
TheGuyInCharge(tm), Ketyra Designs, Inc.
"For every step I take, I find somebody stepping on my heels."
-- anonymous
"That's IT! I'm gonna slap Dr.Watson with a malpractice suit!!" --Keihra
! I reserve the right to bill spammers for my time and disk space !
---------- Forwarded message ----------
Date: Thu, 28 May 1998 20:18:56 -0400
From: CERT Advisory <cert-advisory at cert.org>
Reply-To: cert-advisory-request at cert.org
To: cert-advisory at coal.cert.org
Subject: CERT Summary CS-98.05
-----BEGIN PGP SIGNED MESSAGE-----
- ---------------------------------------------------------------------------
CERT* Summary CS-98.05 - SPECIAL EDITION
May 28, 1998
This special edition of the CERT Summary reports new types of exploit methods
related to those discussed in CS-98.04. Special Edition CERT Summary CS-98.04
is available at
ftp://ftp.cert.org/pub/cert_summaries/CS-98.04
All of these attacks occur on machines running "named" (domain name server
software, part of BIND).
Past CERT Summaries are available from
ftp://ftp.cert.org/pub/cert_summaries/
- ---------------------------------------------------------------------------
The CERT Coordination Center has received reports of new kinds of intruder
activity indicating that intruders are targeting machines running vulnerable
versions of "named" (domain name server software that is part of
BIND). Thousands of sites running unpatched, vulnerable versions of "named"
are known to have been compromised through exploit methods discussed here and
in CS-98.04.
Most of the compromised machines reported to us have been Intel-based machines
running Linux; however, machines of other architectures running vulnerable
versions of "named" have had their "named" processes crash.
While intruders appear to be using tools that exploit this vulnerability on
Intel-based machines, it would not be difficult for intruders to adapt
existing tools to exploit the vulnerability on other architectures.
We encourage you to review CERT Advisory CA-98.05, which describes the BIND
inverse query vulnerability that is being exploited, and to apply the
appropriate patches if you have not done so already. The advisory is available
at
http://www.cert.org/advisories/CA-98.05.bind_problems.html
Since the creation of the CERT/CC nearly 10 years ago, part of our mission has
been and is to facilitate communications between affected sites and law
enforcement agencies. The CERT/CC has been informed by the FBI (Federal Bureau
of Investigation) that they are actively investigating compromises related to
this special edition CERT summary. The FBI is seeking information from
affected sites on the exploitation of these vulnerabilities. If you would like
to report activities at your site to the FBI, please contact the FBI at
phone: +1 202 324 6715
email: nipc.watch at fbi.gov
or the CERT/CC.
Description of New Attack Methods
- ---------------------------------
In addition to the current attacks described in CS-98.04, other toolkits have
been discovered, including one with the potential to be self-replicating. The
self-replicating tool does not replicate by default.
Sites that have applied patches or upgraded to a version of "named" that is
not vulnerable to the inverse query vulnerability (described in CA-98.05) are
not vulnerable to this attack method.
Currently, this toolkit attempts to compromise a machine using the bind
inverse query vulnerability. If the exploitation attempt is successful, it can
- Create a blank line in the password file and add the user
"w0rm" to the password file (with no password)
- Create a root setuid version of the shell (/bin/sh)
in /tmp/.w0rm
- Remove the file /etc/hosts.deny
- Restart "named" (because the exploit of the buffer overflow
will cause "named" to crash)
- Create the file /tmp/.X11x with an html page. The toolkit
also attempts to look for index.html files located on the
file system of the compromised machine and attempts to
alter them. This attempt fails in the toolkit as it is
currently distributed.
- Create the directory /tmp/.w0rm0r and the file /tmp/w0rmishere
- Get the tar file called ADMw0rm.tgz via ftp from the
previously compromised machine, unpack it, and place it in
/tmp/.w0rm0r.
- Execute the ADMw0rm command from the downloaded archive
- Send via email the IP address of the local machine to
an external email address
- Remove any logs located in /var/log/* and the file /tmp/.w0rm
The order in which these steps are performed might vary, and all steps might
not be performed in all compromises.
In other attack methods, we are seeing intruders compromise machines running
vulnerable versions of "named"; as part of the exploit they open xterm windows
from the compromised machine, displaying back to the intruder's machine. The
intruder then has a privileged interactive session on the compromised machine.
What to Look for
- ----------------
In addition to the items listed in CERT Summary CS-98.04, you should look for
the following to help you detect this specific activity:
- Accounts and blank lines added to the password file
- Logins to unauthorized accounts (accounts created by the
intruder)
- The deletion of log files or the hosts.deny file
- Crashes or restarts of "named"
- The existence of the files or directories:
/tmp/.w0rm
/tmp/.w0rm0r
/tmp/w0rmishere
ADMw0rm.tgz
- Unauthorized replacement of index.html files
- xterm connections originating from internal machines
displaying on remote machines
If you determine that your systems might have been root compromised as a
result of this activity, we recommend that you disconnect the affected host
from the network and encourage you to refer to the "Recovering from an
Incident" web page available at
http://www.cert.org/nav/recovering.html
- ---------------------------------------------------------------------------
How to Contact the CERT Coordination Center
Email cert at cert.org
Phone +1 412-268-7090 (24-hour hotline)
CERT personnel answer 8:30-5:00 p.m. EST
(GMT-5)/EDT(GMT-4), and are on call for
emergencies during other hours.
Fax +1 412-268-6989
Postal address
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
USA
To be added to our mailing list for CERT advisories and bulletins, send your
email address to
cert-advisory-request at cert.org
In the subject line, type
SUBSCRIBE your-email-address
CERT advisories and bulletins are posted on the USENET news group
comp.security.announce
CERT publications, information about FIRST representatives, and other
security-related information are available for anonymous FTP from
http://www.cert.org/
ftp://ftp.cert.org/pub/
If you wish to send sensitive incident or vulnerability information to CERT
staff by electronic mail, we strongly advise you to encrypt your message.
We can support a shared DES key or PGP. Contact the CERT staff for more
information.
Location of CERT PGP key
ftp://ftp.cert.org/pub/CERT_PGP.key
- ---------------------------------------------------------------------------
Copyright 1998 Carnegie Mellon University. Conditions for use, disclaimers,
and sponsorship information can be found in
http://www.cert.org/legal_stuff.html and ftp://ftp.cert.org/pub/legal_stuff .
If you do not have FTP or web access, send mail to cert at cert.org with
"copyright" in the subject line.
* CERT is registered in the U.S. Patent and Trademark Office.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBNW3ntHVP+x0t4w7BAQEEHAQAs5+aAXexLEomkMrQVzleDjaLa3PnZ46E
t8RZlALGVL18fcNQ/ekvuLs10BumyjZmyNFjDEYTpf7ILy99ZxjaWNGd8JQUOLod
Gy0ghpfqieo2bVbd4RC/JJfSWbp4+jS/Ck+BSKeXC5zYufnOC3X2czBNJizY700H
kdp49tjEHMs=
=XXw2
-----END PGP SIGNATURE-----
----- End forwarded message -----
--
_/_/ _/ _/ _/ _/ _/_/_/ _/_/_/ Nikos Mavroyanopoulos
_/ _/_/ _/ _/_/ _/ _/ _/ nmav at freemail.gr
_/ _/ _/ _/ _/ _/_/_/ _/_/_/ finger/pgpkey: ngm at beryl.kapatel.gr
--
====================================================================
Gia boithia (h na diagrafhte) e-mail sto majordomo at argos.hol.gr
Ta archives tis listas einai sto http://www.argos.hol.gr/lists :
prin steilete kapoia erothsh psakte mipos exei hdh apanththei.
Gia opoiodipote problima stilte e-mail ston owner-linux-greek-users
====================================================================
More information about the Linux-greek-users
mailing list