[49844] in North American Network Operators' Group
RE: Just an FYI - Apache Worm on the loose
daemon@ATHENA.MIT.EDU (Phil Rosenthal)
Wed Jul 10 18:42:53 2002
Reply-To: <pr@isprime.com>
From: "Phil Rosenthal" <pr@isprime.com>
To: <nanog@nanog.org>
Date: Wed, 10 Jul 2002 18:42:16 -0400
In-Reply-To: <Pine.LNX.4.21.0207102329260.17534-100000@staff.opaltelecom.net>
Errors-To: owner-nanog-outgoing@merit.edu
If you want to be really proactive... Just filter out port 80, and then
you can't get hacked...
--Phil
-----Original Message-----
From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of
Stephen J. Wilcox
Sent: Wednesday, July 10, 2002 6:30 PM
To: Scott Francis
Cc: Jason Legate; nanog@nanog.org
Subject: Re: Just an FYI - Apache Worm on the loose
If you want to be proactive, filter this port across your backbone and
you will very quickly see what hosts have been compromised.. on the
other hand individual customers seem to use all their bandwidth so they
tend to phone in pretty quick!
Steve
On Wed, 10 Jul 2002, Scott Francis wrote:
> On Tue, Jul 09, 2002 at 02:26:23PM -0700, jlegate@alienchick.com said:
> > There is an Apache worm out there, and it uses port 2001/udp to
> > operate. You may wanna scan your own boxes for this open port.
>
> Announced last week on BUGTRAQ and elsewhere.
> http://online.securityfocus.com/archive/1/279529
>
> (and was it _really_ necessary to post a hex dump of the entire thing?
> The actual source is available linked from the BUGTRAQ post above ...)
>
