Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 25 Mar 2002 13:28:00 -0500 (EST)
From:      Scott Christopher Dodson <gsi22419@gsaix2.cc.GaSoU.EDU>
To:        Jesse Geddis <sgeine@yahoo.com>
Cc:        Jarrod Sayers <Jarrod.Sayers@unisa.edu.au>, FreeBSD-STABLE <freebsd-stable@FreeBSD.ORG>
Subject:   RE: attempted exploits
Message-ID:  <Pine.A41.3.96.1020325132703.32336A-100000@gsaix2.cc.GaSoU.EDU>
In-Reply-To: <NGBBKILMGLGEDIHMGJANMELGCBAA.sgeine@yahoo.com>

next in thread | previous in thread | raw e-mail | index | archive | help

If you look at the majority of the recent problems with worms all but the
latest had patches available for 6 months or more prior to major
outbreaks.  Don't let the facts get in the way of your opinions...

--
scott


On Mon, 25 Mar 2002, Jesse Geddis wrote:

> wow, this is nuts. getting it from 5 hosts on the same B now lol.
> seems to propagate quite well. I read through the CERT advisory. seems
> like a well written worm with many points of access. certainly fills
> my log files. I feel sorry for all the NT users who have to deal with
> MS timetable for patches lol
>=20
> -----Original Message-----
> From: owner-freebsd-stable@FreeBSD.ORG
> [mailto:owner-freebsd-stable@FreeBSD.ORG]On Behalf Of Jarrod Sayers
> Sent: Sunday, March 24, 2002 9:58 PM
> To: 'sgeine@yahoo.com'; FreeBSD-STABLE
> Subject: RE: attempted exploits
>=20
>=20
> Welcome back Nimda!  We have noticed a sharp rise in the number of
> attacks
> starting over the weekend here.
>=20
> Jarrod Sayers
> Information Technology Services Unit
> University of South Australia, Magill Campus.
> Phone: +61 8 8302 4809
> http://people.unisa.edu.au/jarrod.sayers
>=20
>=20
> > -----Original Message-----
> > From: Jesse Geddis [mailto:sgeine@yahoo.com]
> > Sent: Monday, 25 March 2002 4:23 PM
> > To: FreeBSD-STABLE
> > Subject: attempted exploits
> >
> >
> > wow, this person is quite effective. they've been trying this since
> > this morning 4mins after i got my web server up. been doing it every
> > half hour for 7 hours lol. trying to execute arbitrary Windows code
> on
> > a FreeBSD server!
> >
> > [Sun Mar 24 20:41:55 2002] [error] [client 63.198.148.139] File does
> > not exist: /archive/www/cia/scripts/..=C1../winnt/system32/cmd.exe
> > [Sun Mar 24 20:42:05 2002] [error] [client 63.198.148.139] File does
> > not exist: /archive/www/cia/scripts/..=C0=AF../winnt/system32/cmd.exe
> > [Sun Mar 24 20:42:10 2002] [error] [client 63.198.148.139] File does
> > not exist: /archive/www/cia/scripts/..=C1../winnt/system32/cmd.exe
> > [Sun Mar 24 20:42:29 2002] [error] [client 63.198.148.139] File does
> > not exist: /archive/www/cia/scripts/..%5c../winnt/system32/cmd.exe
> > [Sun Mar 24 21:13:11 2002] [error] [client 63.198.148.139] File does
> > not exist: /archive/www/cia/scripts/root.exe
> > [Sun Mar 24 21:13:12 2002] [error] [client 63.198.148.139] File does
> > not exist: /archive/www/cia/MSADC/root.exe
> > [Sun Mar 24 21:13:13 2002] [error] [client 63.198.148.139] File does
> > not exist: /archive/www/cia/c/winnt/system32/cmd.exe
> > [Sun Mar 24 21:13:14 2002] [error] [client 63.198.148.139] File does
> > not exist: /archive/www/cia/d/winnt/system32/cmd.exe
> > [Sun Mar 24 21:13:15 2002] [error] [client 63.198.148.139] File does
> > not exist: /archive/www/cia/scripts/..%5c../winnt/system32/cmd.exe
> > [Sun Mar 24 21:13:17 2002] [error] [client 63.198.148.139] File does
> > not exist:
> >
> /archive/www/cia/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.e
> > xe
> > [Sun Mar 24 21:13:19 2002] [error] [client 63.198.148.139] File does
> > not exist:
> >
> /archive/www/cia/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.e
> > xe
> > [Sun Mar 24 21:13:20 2002] [error] [client 63.198.148.139] File does
> > not exist:
> >
> /archive/www/cia/msadc/..%5c../..%5c../..%5c/..=C1../..=C1../..=C1../winn=
t/s
> > ystem32
> > /cmd.exe
> >
> > Jesse Geddis
> >
> >
> >
> > "My fellow Americans, I've signed legislation that will outlaw
> Russia
> > forever. We begin bombing in five minutes."
> > --Ronald Reagan
> >
> >
> > _________________________________________________________
> > Do You Yahoo!?
> > Get your free @yahoo.com address at http://mail.yahoo.com
> >
> >
> > To Unsubscribe: send mail to majordomo@FreeBSD.org
> > with "unsubscribe freebsd-stable" in the body of the message
> >
> >
> >
>=20
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-stable" in the body of the message
>=20
>=20
> _________________________________________________________
> Do You Yahoo!?
> Get your free @yahoo.com address at http://mail.yahoo.com
>=20
>=20
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-stable" in the body of the message
>=20


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.A41.3.96.1020325132703.32336A-100000>