From owner-freebsd-security  Fri Sep 11 03:28:59 1998
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id DAA14022
          for freebsd-security-outgoing; Fri, 11 Sep 1998 03:28:59 -0700 (PDT)
          (envelope-from owner-freebsd-security@FreeBSD.ORG)
Received: from office.omc.net (office.omc.net [195.185.142.22])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id DAA14017
          for <security@FreeBSD.ORG>; Fri, 11 Sep 1998 03:28:56 -0700 (PDT)
          (envelope-from LutzRab@omc.net)
Received: from lutz (lutz.omc.net [195.185.142.3])
	by office.omc.net (8.9.1/8.9.1) with SMTP id MAA04513
	for <security@FreeBSD.ORG>; Fri, 11 Sep 1998 12:29:24 +0200 (CEST)
Message-Id: <199809111029.MAA04513@office.omc.net>
From: "Lutz Rabing" <LutzRab@omc.net>
Organization: OMCnet IS GmbH
To: security@FreeBSD.ORG
Date: Fri, 11 Sep 1998 12:30:33 +0200
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: fingerd exploit 
Reply-to: LutzRab@omc.net
References: <Pine.GSO.4.02.9809110115070.27098-100000@echonyc.com>
In-reply-to: <Pine.BSF.3.96.980911090428.4232A-100000@bofh.fast.net.uk>
X-mailer: Pegasus Mail for Win32 (v3.01b)
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


Has anybody heared of a fingerd exploit ?

I found many fingerd log messages from many different destinations on one
of our webservers, which is unusual. There were even 10 fingerd's running
under uid 'nobody'.

(fingerd has been disabled by now)

Thanks,
Lutz Rabing -OMCnet-

Mit freundlichen Gruessen,
Lutz Rabing -OMCnet-

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message