Re: amd exploit(ed)?

[Erich.Meier () INFORMATIK UNI-ERLANGEN DE (Erich Meier)]

On Sun, May 07, 2000 at 04:13:34PM +0000, Paulo Ribeiro wrote:
> Hi, all.
>
> While I's checking the system, look what I've found:
>
> May  7 01:11:19 lab syslogd: Cannot glue message parts together
> May  7 01:11:19 lab 27>May  7 01:11:19 amd[1047]: amq requested mount of
[...]
> ~HF«~IF¸°^K~Ió~MN¬~MV¸Í~@1Û~IØ@Í~@èÊÿÿÿ/bin/sh -c
> ls;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> May  7 01:11:19 lab
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA^Eõÿ¿^Eõÿ¿^Eõÿ¿^Eõÿ¿^Eõÿ¿,
> but code is disabled
> May  7 01:12:40 lab kernel: svc: unknown program 300019 (me 100021)
>
> Was it an attempt to exploit amd?

That's the signature of a well-known amd exploit (see securityfocus). If you're
running an i386 Linux machine, congratulations, you've been hacked.

Erich

--
Erich Meier                              Erich.Meier () informatik uni-erlangen de
                                 http://www4.informatik.uni-erlangen.de/~meier/
          "There has been much talk about component architectures
           but only one true success: Unix pipes."  (R. Pike)