Full Disclosure mailing list archives
RE: AMDPatchB & InstallStub
From: "Noel, Marcus" <Marcus.Noel () tri-c edu>
Date: Wed, 17 Sep 2003 17:46:51 -0400
Looks like irc to me. -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Michael Linke Sent: Wednesday, September 17, 2003 3:06 PM To: full-disclosure () lists netsys com Subject: [Full-disclosure] AMDPatchB & InstallStub At one of our Computers with Internet Access, I found a strange program running. amdpatchB.exe(38 KB) This program is trying to get Internet Access while starting. amdpatchB.exe is connecting 63.246.134.50:9900. There is a text based protocol running on 63.246.134.50 at a service on port 9900. See Telnet output: ________________________________________________________ telnet 63.246.134.50 9900 Trying 63.246.134.50... Connected to 63.246.134.50. Escape character is '^]'. NOTICE AUTH :*** Looking up your hostname NOTICE AUTH :*** Checking Ident NOTICE AUTH :*** Found your hostname help :Drones2.newiso.org 451 * :Register first. _________________________________________________________ I used Google to look for this filename but got no result. Any ideas what this is? Regards, Michael _____________________ -----Ursprüngliche Nachricht----- Von: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] Im Auftrag von Richard Johnson Gesendet: Mittwoch, 17. September 2003 17:48 An: full-disclosure () lists netsys com Betreff: [Full-Disclosure] Re: openssh remote exploit In article <20030917132443.GA17620 () SDF LONESTAR ORG>, petard <petard () sdf lonestar org> wrote:
An exploit would certainly constitute such evidence. Have you seen anything that indicates this bug is exploitable?
I'm beginning to suspect that compromises attributed to this bug on Linux hosts were coincidental. They could have happened via exploits of other problems. That's because no-one has any forensics data or logs that indicate this particular bug as an attack route. However, the chance is not worth taking in practice, so upgrade time it is. Richard -- My mailbox. My property. My personal space. My rules. Deal with it. http://www.river.com/users/share/cluetrain/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: AMDPatchB & InstallStub Russell Kaiser (Sep 17)
- <Possible follow-ups>
- RE: AMDPatchB & InstallStub Noel, Marcus (Sep 17)