Security Incidents mailing list archives
New variants of Slapper worm using UDP ports other than 2002 today -- 1978 and 4156 -- (and they were apparently active yesterday as well)
From: "H. Morrow Long" <morrow.long () yale edu>
Date: Sun, 22 Sep 2002 16:10:05 -0400
Several (see http://diswww.mit.edu/charon/nanog/52239) have noticed Slapper using UDP port 4156 today (and apparently yesterday as well as I can see from netflow logs). I've also noticed a Slapper variant apparently using UDP port 1978 today as well (one of our hosts on which Slapper is no longer active is continuing to receive UDP packets to and from port 1978 from many Internet sites). H. Morrow Long University Information Security Officer Director, Information Security Office Yale University, ITS ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service.For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- New variants of Slapper worm using UDP ports other than 2002 today -- 1978 and 4156 -- (and they were apparently active yesterday as well) H. Morrow Long (Sep 22)