Security Incidents mailing list archives

Re: Connections to port 635 ??

From: ben () ION AS UTEXAS EDU (Ben Laws)
Date: Fri, 23 Jun 2000 12:00:23 -0500


Gunther Stammwitz wrote:

someone tried very often to connect to port 635.


Howdy -- Linux mountd runs on port 635.  Your subnet
was scanned for systems running this daemon.  This
scan is presumably a precursor to an attack.  Verify
that you are not running any Linux systems
vulnerable to mountd exploits.  Good port references
can be found at:

http://advice.networkice.com/advice/Exploits/Ports/
http://www.robertgraham.com/pubs/firewall-seen.html
http://www.isi.edu/in-notes/iana/assignments/port-numbers

ciao,
Ben Laws
Systems Analyst
Hobby-Eberly Telescope
UT McDonald Observatory

Current thread:

Netbus portscan ( port 12345), (continued)
- Netbus portscan ( port 12345) lmonin () METACONCEPT COM (Jun 21)
  - Re: Netbus portscan ( port 12345) James T. Perry (Jun 22)
- scanned - strange! Sir Scriptzalot (Jun 21)
- (forw) Jennifer Granick Audio Interview now online Elias Levy (Jun 21)
- Connections to port 635 ?? Gunther Stammwitz (Jun 21)
  - Connections to port 635 ?? Klaus Moeller (Jun 23)
  - Re: Connections to port 635 ?? Bill (Jun 23)
  - stranger ftp kill Max Gribov (Jun 23)
    - Re: stranger ftp kill frank () STUDENT2 RUG AC BE (Jun 23)
    - Re: stranger ftp kill jose (Jun 26)
  - Re: Connections to port 635 ?? Ben Laws (Jun 23)
  - Re: Connections to port 635 ?? Robert Graham (Jun 23)
- Nike Site taken over F_SecurityList Jo (Jun 21)
  - Re: Nike Site taken over Steve (Jun 22)
  - Re: Nike Site taken over Ex Machina (Jun 22)
    - Re: Nike Site taken over Joel de la Garza (Jun 23)
    - Re: Nike Site taken over Aviram Jenik (Jun 24)
    - Re: Nike Site taken over Valdis Kletnieks (Jun 26)
    - funky syslog entry klug (Jun 26)
    - Re: funky syslog entry Valdis Kletnieks (Jun 27)
    - Re: funky syslog entry Jens Hektor (Jun 27)

(Thread continues...)