lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 2 May 2004 17:54:03 -0500 (CDT) From: Damian Menscher <menscher@...c.edu> To: bugtraq@...urityfocus.com Subject: Re: Will the Sasser worm become the next Blaster? Gadi Evron <ge linuxbox org> wrote: > if you simply port scan for Sasser you get many false positives, as > that port (5554) is also used by Oracle. If you get "200 OK" as a > reply though in the first packet, it's Sasser. Another false positive is IRIX boxes which listen to port 5554/tcp for esp-httpd (their "Embedded Support Partner"). From the default /etc/inetd.conf: sgi-esphttp stream tcp wait root /usr/etc/esphttpd esphttpd -u300 To cut down on false positives, I tried scanning for BOTH 5554/tcp AND 9996/tcp. Unfortunately we found that very few (about 2%) of the infected machines had both ports open. Another 1% had only port 9996/tcp open. The remaining 97% had only 5554 open. Damian Menscher -- -=#| Physics Grad Student & SysAdmin @ U Illinois Urbana-Champaign |#=- -=#| 488 LLP, 1110 W. Green St, Urbana, IL 61801 Ofc:(217)333-0038 |#=- -=#| <menscher@...c.edu> www.uiuc.edu/~menscher/ Fax:(217)333-9819 |#=- -=#| The above opinions are not necessarily those of my employers: |#=- -=#| UIUC CITES Security Group || Beckman Imaging Technology Group |#=-
Powered by blists - more mailing lists