1 Apr
2000
1 Apr
'00
01:51
On Fri, 31 Mar 2000, Chrissy wrote:
This looks terrible.. anyone have any ideas?
Mar 30 20:45:00 rox /USR/SBIN/CRON[16114]: (root) CMD ( test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-crons ) Mar 30 20:46:14 rox ~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P~P <snip> Mar 30 20:46:55 rox named[380]: Cleaned cache of 57 RRsets
I've got sendmail, web, named, and identd open to the world.. and pop3, ftp, ssh open to accepted ip ranges (via IPCHAINS)
Please help..this sucks.
Looks like a named buffer overflow exploit. What version of named are you using? -- Bob F EMail FBob@wt.net A Truly Wise Man Never Plays Leapfrog With A Unicorn...