full-disclosure - Patched Solaris Boxes being Hacked??

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <B0DF0180764CDC4888BACFD27C84125F08AE5644@stl02mexc11.corp.chartercom.com>
From: RCompton at chartercom.com (Compton, Rich)
Subject: Patched Solaris Boxes being Hacked??

Anyone out there have more information on ISC's reports of patched Solaris
boxes being compromised?  Here's the quote from the Incident Handler's Diary
for today:

"Solaris 8 Hacks. We've received a few reports of significant intrusions
into networks of patched Solaris 8 machines. Initial analysis indicates what
appears to be a multi-vector attack, using finger, rpcbind, and ftp. In one
network, the systems that got broken into did not have tcpwrappers installed
nor did they have the rpcbind from Wietse Venema and Casper Dik that has
tcpwrapper support. However, there were Solaris 8 systems in the same
machine room that are behind on patches, but have tcp wrappers installed and
they were not broken into. If there have been other cases of similar
intrusions in the past few days, the Storm Center would like to hear about
it."

-Rich Compton