Re: Will the Sasser worm become the next Blaster?
From: Damian Menscher (menscher_at_uiuc.edu)
Date: 05/03/04
- Previous message: Javier Fernandez-Sanguino: "Re: New LSASS-based worm finally here (Sasser)"
- Maybe in reply to: kers0r: "Will the Sasser worm become the next Blaster?"
- Next in thread: Pullum, Stephen: "RE: Will the Sasser worm become the next Blaster?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 2 May 2004 17:54:03 -0500 (CDT) To: bugtraq@securityfocus.com
Gadi Evron <ge linuxbox org> wrote:
> if you simply port scan for Sasser you get many false positives, as
> that port (5554) is also used by Oracle. If you get "200 OK" as a
> reply though in the first packet, it's Sasser.
Another false positive is IRIX boxes which listen to port 5554/tcp for
esp-httpd (their "Embedded Support Partner"). From the default
/etc/inetd.conf:
sgi-esphttp stream tcp wait root /usr/etc/esphttpd esphttpd -u300
To cut down on false positives, I tried scanning for BOTH 5554/tcp AND
9996/tcp. Unfortunately we found that very few (about 2%) of the
infected machines had both ports open. Another 1% had only port
9996/tcp open. The remaining 97% had only 5554 open.
Damian Menscher
-- -=#| Physics Grad Student & SysAdmin @ U Illinois Urbana-Champaign |#=- -=#| 488 LLP, 1110 W. Green St, Urbana, IL 61801 Ofc:(217)333-0038 |#=- -=#| <menscher@uiuc.edu> www.uiuc.edu/~menscher/ Fax:(217)333-9819 |#=- -=#| The above opinions are not necessarily those of my employers: |#=- -=#| UIUC CITES Security Group || Beckman Imaging Technology Group |#=-
- Previous message: Javier Fernandez-Sanguino: "Re: New LSASS-based worm finally here (Sasser)"
- Maybe in reply to: kers0r: "Will the Sasser worm become the next Blaster?"
- Next in thread: Pullum, Stephen: "RE: Will the Sasser worm become the next Blaster?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
