[32504] in bugtraq
Re: Router Worm?
daemon@ATHENA.MIT.EDU (Jose Nazario)
Thu Nov 20 12:47:00 2003
Date: Wed, 19 Nov 2003 20:05:31 -0500 (EST)
From: Jose Nazario <jose@monkey.org>
To: "Jay D. Dyson" <jdyson@treachery.net>
Cc: Bugtraq <bugtraq@securityfocus.com>
In-Reply-To: <Pine.LNX.4.58.0311191434110.18469@predator.treachery.net>
Message-ID: <Pine.BSO.4.58.0311192003490.29921@naughty.monkey.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
its welchia/nachi. when it can't connect via 135/tcp, it will attempt an
exploit against a webdav server (see MS03-007).
i've seen an uptick in this in the past couple of days, too, visible on a
few httpd servers i track. and i, too, was caught off guard until someone
pointed out it was nachi to me. digging into the tech details showed that
i (and many of us) had been overlooking a secondary attack.
___________________________
jose nazario, ph.d. jose@monkey.org
http://monkey.org/~jose/
