LION worm alert

Jeff Silverman jeffs at kant.ee.washington.edu
Fri Mar 23 17:02:13 PST 2001


"R. David Whitlock" wrote:

>

> Good afternoon all,

>

> I know that DaveD is usually the man with those hot, fresh vulnerabily

> notifications, but this one seemed important enought to this group to

> forward on immediately. The methods used here almost guarantee that there

> will be a large number of compromised systems.

Actually, David got credit in one of the stories for helping find the
problem.

>

> If you are running any version of bind ( named ) at home under linux other

> than 9.1.0-REL ( or higher ) or 8.2.3-REL please download the infection

> scanning software mentioned in the following advisory, and check your

> state.

>

> You can check what version of named you are running by issuing the

> following command ( as any user ):

>

> $ named -v

> named 8.2.3-REL Mon Jan 29 17:18:45 PST 2001

>



I suspect that named on Intel/Solaris is not vulnerable to this virus,
BUT... I can't get the ISC ftp server to send me a copy. Has somebody
here downloaded the tarball from
ftp://ftp.isc.org/isc/bind/src/8.2.3/bind-src.tar.gz ? If so, would
you please E-mail it to me as a MIME encoded attachment?


Many thanks,


Jeff



--
Jeff Silverman, sysadmin for the Research Computing Systems (RCS)
University of Washington, School of Engineering, Electrical Engineering
Dept.
Box 352500, Seattle, WA, 98125-2500 FAX: (206) 221-5264 Phone (206)
543-9378
jeffs at rcs.ee.washington.edu http://rcs.ee.washington.edu/~jeffs


More information about the Linux mailing list