LION worm alert

Jeff Silverman jeffs at
Fri Mar 23 17:02:13 PST 2001

"R. David Whitlock" wrote:


> Good afternoon all,


> I know that DaveD is usually the man with those hot, fresh vulnerabily

> notifications, but this one seemed important enought to this group to

> forward on immediately. The methods used here almost guarantee that there

> will be a large number of compromised systems.

Actually, David got credit in one of the stories for helping find the


> If you are running any version of bind ( named ) at home under linux other

> than 9.1.0-REL ( or higher ) or 8.2.3-REL please download the infection

> scanning software mentioned in the following advisory, and check your

> state.


> You can check what version of named you are running by issuing the

> following command ( as any user ):


> $ named -v

> named 8.2.3-REL Mon Jan 29 17:18:45 PST 2001


I suspect that named on Intel/Solaris is not vulnerable to this virus,
BUT... I can't get the ISC ftp server to send me a copy. Has somebody
here downloaded the tarball from ? If so, would
you please E-mail it to me as a MIME encoded attachment?

Many thanks,


Jeff Silverman, sysadmin for the Research Computing Systems (RCS)
University of Washington, School of Engineering, Electrical Engineering
Box 352500, Seattle, WA, 98125-2500 FAX: (206) 221-5264 Phone (206)
jeffs at

More information about the Linux mailing list