Re: [cobalt-users] New Linux worm 'Adore' makes its appearance

[Rob kennedy <rob@xxxxxxxxx>]

There's lots of good info on this on http://www.sans.org/y2k/adore.htm

It's basicly lion, but looks for 3 additional exploits in
linux.. and only one being effected on a raq server (3 and 4).. that i can tell.

1. LPRng: Not installed on the cobalts
2. rpc-statd: comes w/ nfs-utils.. cobalts come w/ patched version
3. BIND: Update your bind with the patch at cobalt.com/support/
4. wu-ftpd: Cobalts use proftpd by default

Again, see the page linked above for full details :)

Hope this helps someone..

Rob

-- 
Rob Kennedy
ASPRE, Inc.
rkennedy@xxxxxxxxx
http://www.aspre.net/

Managed e-Business that works
---------------------------------
the first exclusive e-Business Application Service Provider (ASP)

t. 215.957.2266 Ext. 2145
f. 215.957.2277

113 Rock Road
Horsham, PA 19044

On Wed, 4 Apr 2001, Tim M. Muldoon wrote:

> The third Linux virus in almost as many months hit the Internet this week.
>
> Known as the Adore worm, the program is designed to create so-called back
> doors in the security of Linux systems and send information identifying the
> compromised systems to four different e-mail addresses hosted on servers in
> China and the United States.
>
> http://www.zdnet.com/zdnn/stories/news/0,4586,5080656,00.html
>
> _______________________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To Subscribe or Unsubscribe, please go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>