New worm to affect RH

[Mitchell Henderson]

Hi,
        I don't know if you could call it new, it's really a combo of everything that 
we've seen as of late. 
        it exploits bind, lpd, statd, and wu-ftp 2.6.0 .  The basic signs are that it 
replaces /etc/cron.daily/0anacron with a hacked version of it to start the scans and 
such.  Also after a day of scanning, the logs of the scan, the ip of the local box, 
and the shadow are sent to an email address in china. [EMAIL PROTECTED] and 
[EMAIL PROTECTED] .
if anyone wants a copy of the worm email me and i'll send it to them.

Mitchell Henderson              [EMAIL PROTECTED]



_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list