Re: amd exploit(ed)?

[jim () JIMZ NET (Jim Zajkowski)]

On Sun, May 07, 2000 at 04:13:34PM +0000, Paulo Ribeiro wrote:

> While I's checking the system, look what I've found:

> May  7 01:11:19 lab syslogd: Cannot glue message parts together
> May  7 01:11:19 lab 27>May  7 01:11:19 amd[1047]: amq requested mount of
> ~HF«~IF¸°^K~Ió~MN¬~MV¸Í~@1Û~IØ@Í~@èÊÿÿÿ/bin/sh -c
> ls;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> May  7 01:11:19 lab
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA^Eõÿ¿^Eõÿ¿^Eõÿ¿^Eõÿ¿^Eõÿ¿,
> but code is disabled
> May  7 01:12:40 lab kernel: svc: unknown program 300019 (me 100021)

> Was it an attempt to exploit amd?

Yes.  There was (around August, 1999) a buffer exploit against some
versions of Linux amd.  The Debian page is at
  http://www.debian.org/security/1999/19991018a
and redhat:
  http://www.redhat.com/support/errata/RHSA1999032_O1.html

--Jim

--
Jim Zajkowski
System Administrator
ITD Contract Services