[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-router
Subject:    Re: [LRP] Question - Is LRP susceptible to the Lion Worm ?
From:       Straub Bela <stbela () sugonet ! hu>
Date:       2001-06-29 13:26:26
[Download RAW message or body]

Martin Simmons wrote:

> Is LRP susceptible to the Lion Worm ? I've noticed some odd denied

The Lion can infecting BIND.
More info , updates and program for checking system:
http://www.ists.dartmouth.edu/IRIA/knowledge_base/tools/lionfind.htm
http://www.sans.org/y2k/lion.htm

> packets in the "Log File: messages" , and I'm not sure whether they're
> external probes, or the router doing weird things (if infected).
> Example;
>
> Jun 26 11:35:33 myrouter kernel: Packet log: input DENY eth0 PROTO=6
> 208.184.162.71:38070 24.77.58.25:53 L=44 S=0x00 I=0 F=0x0000 T=246 (#42)
> Jun 26 11:35:33 myrouter kernel: Packet log: input DENY eth0 PROTO=6
> 64.14.200.154:24846 24.77.58.25:53 L=44 S=0x00 I=0 F=0x0000 T=244 (#42)
> Jun 26 11:35:33 myrouter kernel: Packet log: input DENY eth0 PROTO=6
> 64.78.235.14:54504 24.77.58.25:53 L=44 S=0x00 I=0 F=0x0000 T=243 (#42)
> Jun 26 11:35:33 myrouter kernel: Packet log: input DENY eth0 PROTO=6
> 216.220.39.42:22002 24.77.58.25:53 L=44 S=0x00 I=0 F=0x0000 T=248 (#42)
>
> Is it possible for the Lion Worm (or similar work) to infect the virtual
> file system?  I know after a couple of such attacks the router gets
> sluggish.
>
> _______________________________________________
> linux-router maillist  -  linux-router@linuxrouter.org
> http://www.linuxrouter.org/mailman/listinfo/linux-router


_______________________________________________
linux-router maillist  -  linux-router@linuxrouter.org
http://www.linuxrouter.org/mailman/listinfo/linux-router

[prev in list] [next in list] [prev in thread] [next in thread]