[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: port 515
- To: linux-il(at-nospam)linux.org.il
- Subject: Re: port 515
- From: Yotam Rubin <yotam(at-nospam)makif.omer.k12.il>
- Date: Sun, 1 Jul 2001 01:56:16 +0300
- Delivered-To: linux.org.il-linux-il@linux.org.il
- In-Reply-To: <Pine.LNX.4.21.0106302209300.15987-200000@nanu.visionforisrael.com>; from cedarc@visionforisrael.com on Sat, Jun 30, 2001 at 10:13:01PM +0300
- Mail-Followup-To: linux-il@linux.org.il
- References: <Pine.LNX.4.21.0106302209300.15987-200000@nanu.visionforisrael.com>
- Sender: linux-il-bounce(at-nospam)cs.huji.ac.il
- User-Agent: Mutt/1.3.15i
Recent worms have been known to hit port 515, there's an vulnerability in
lprng which enables an attacker to execute arbitrary code. I assume these
packets are the result of the recent worms.
On Sat, Jun 30, 2001 at 10:13:01PM +0300, Cedar Cox wrote:
>
> What is one to think of this? These "random" packets have hit my firewall
> on port 515 recently.. comments?
>
>
>
> -- Attached file included as plaintext by Listar --
> -- File: log.txt
>
> Jun 26 22:01:20 Packet log: PROTO=6 64.123.230.249:58963 L=60 S=0x00 I=18619 F=0x4000 T=47 SYN (#23)
> Jun 26 22:01:22 Packet log: PROTO=6 64.123.230.249:58963 L=60 S=0x00 I=18955 F=0x4000 T=47 SYN (#23)
> Jun 26 22:01:28 Packet log: PROTO=6 64.123.230.249:58963 L=60 S=0x00 I=19617 F=0x4000 T=47 SYN (#23)
> Jun 26 22:52:15 Packet log: PROTO=6 213.113.152.232:4902 L=60 S=0x00 I=20130 F=0x4000 T=34 SYN (#23)
> Jun 26 22:52:18 Packet log: PROTO=6 213.113.152.232:4902 L=60 S=0x00 I=21423 F=0x4000 T=34 SYN (#23)
> Jun 29 09:42:41 Packet log: PROTO=6 194.3.198.211:1857 L=60 S=0x00 I=9035 F=0x4000 T=46 SYN (#25)
> Jun 29 09:42:44 Packet log: PROTO=6 194.3.198.211:1857 L=60 S=0x00 I=9228 F=0x4000 T=46 SYN (#25)
> Jun 30 12:40:09 Packet log: PROTO=6 210.51.0.18:3582 L=60 S=0x00 I=54279 F=0x4000 T=44 SYN (#26)
> Jun 30 12:40:12 Packet log: PROTO=6 210.51.0.18:3582 L=60 S=0x00 I=55581 F=0x4000 T=44 SYN (#26)
> Jun 30 21:27:18 Packet log: PROTO=6 209.155.224.20:3715 L=60 S=0x00 I=24436 F=0x4000 T=42 SYN (#26)
>
> =================================================================
> To unsubscribe, send mail to linux-il-request@linux.org.il with
> the word "unsubscribe" in the message body, e.g., run the command
> echo unsubscribe | mail linux-il-request@linux.org.il
>
=================================================================
To unsubscribe, send mail to linux-il-request@linux.org.il with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail linux-il-request@linux.org.il