Security Incidents mailing list archives

Re: lots of interest in port 109 (POP2)

From: jlewis () LEWIS ORG (Jon Lewis)
Date: Wed, 8 Mar 2000 23:42:05 -0500


On Tue, 7 Mar 2000, harikiri wrote:

I can't comment on why POP-2 has become so popular all of a sudden, but I
can also confirm that a client of mine has seen a sweep of its class C for
the service - at two different times, from two unique ip's.


There's an old exploit:
Sekure SDI ipop2d remote exploit - Jun, 02 1999

I don't know why it's so popular all of a sudden.  I've seen at least one
scan in the past few days.

----------------------------------------------------------------------
 Jon Lewis *jlewis () lewis org*|  Spammers will be winnuked or
 System Administrator        |  nestea'd...whatever it takes
 Atlantic Net                |  to get the job done.
_________http://www.lewis.org/~jlewis/pgp for PGP public key__________

Current thread:

lots of interest in port 109 (POP2) Russell Fulton (Mar 05)
- Re: lots of interest in port 109 (POP2) harikiri (Mar 07)
  - Re: lots of interest in port 109 (POP2) Jon Lewis (Mar 08)
- Re: lots of interest in port 109 (POP2) Pavel Kankovsky (Mar 08)
  - Re: lots of interest in port 109 (POP2) Juan M. Courcoul (Mar 08)
    - Re: lots of interest in port 109 (POP2) drkn (Mar 14)
    - Syn and Fin in different packets together Stuart Staniford-Chen (Mar 21)
    - Re: Syn and Fin in different packets together Simple Nomad (Mar 22)
    - Re: Syn and Fin in different packets together Granquist, Lamont (Mar 24)
    - Dramatic increase in UDP Port 137 (NetBIOS Name Service) probe activity Jeffrey D. Carter (Mar 25)
    - Re: Dramatic increase in UDP Port 137 (NetBIOS Name Service) probeactivity Bryan Andersen (Mar 28)
    - Re: Dramatic increase in UDP Port 137 (NetBIOS Name Service) probeactivity Christoph Schneeberger (Mar 29)
    - Re: Dramatic increase in UDP Port 137 (NetBIOS Name Service)probeactivity Bill Pennington (Mar 29)

(Thread continues...)