bugtraq - Re: Will the Sasser worm become the next Blaster?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.53.0405021742370.4460@lx2.physics.uiuc.edu>
Date: Sun, 2 May 2004 17:54:03 -0500 (CDT)
From: Damian Menscher <menscher@...c.edu>
To: bugtraq@...urityfocus.com
Subject: Re: Will the Sasser worm become the next Blaster?

Gadi Evron <ge linuxbox org> wrote:
> if you simply port scan for Sasser you get many false positives, as
> that port (5554) is also used by Oracle. If you get "200 OK" as a
> reply though in the first packet, it's Sasser.

Another false positive is IRIX boxes which listen to port 5554/tcp for
esp-httpd (their "Embedded Support Partner").  From the default
/etc/inetd.conf:
sgi-esphttp stream  tcp wait   root  /usr/etc/esphttpd   esphttpd -u300

To cut down on false positives, I tried scanning for BOTH 5554/tcp AND
9996/tcp.  Unfortunately we found that very few (about 2%) of the
infected machines had both ports open.  Another 1% had only port
9996/tcp open.  The remaining 97% had only 5554 open.

Damian Menscher
-- 
-=#| Physics Grad Student & SysAdmin @ U Illinois Urbana-Champaign |#=-
-=#| 488 LLP, 1110 W. Green St, Urbana, IL 61801 Ofc:(217)333-0038 |#=-
-=#| <menscher@...c.edu> www.uiuc.edu/~menscher/ Fax:(217)333-9819 |#=-
-=#| The above opinions are not necessarily those of my employers: |#=-
-=#| UIUC CITES Security Group || Beckman Imaging Technology Group |#=-