some "scanned with SSH-1.0-SSH_Version_Mapper. Don't panic." in syslog
From: Steffen Dettmer (steffen@dett.de)Date: 12/22/01
- Previous message: Sparro, Dave: "RE: *MAJOR SECURITY BREACH AT CCBILL**"
- Next in thread: Sebastian Jaenicke: "Re: some "scanned with SSH-1.0-SSH_Version_Mapper. Don't panic." in syslog"
- Reply: Sebastian Jaenicke: "Re: some "scanned with SSH-1.0-SSH_Version_Mapper. Don't panic." in syslog"
- Reply: Matthew D. Close: "Re: some "scanned with SSH-1.0-SSH_Version_Mapper. Don't panic." in syslog"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sat, 22 Dec 2001 23:05:18 +0100 From: Steffen Dettmer <steffen@dett.de> To: incidents@securityfocus.com
Hi,
I found the following in syslogs on some servers (running
OpenSSH):
sshd[29575]: scanned from ::ffff:62.154.180.3 with
SSH-1.0-SSH_Version_Mapper. Don't panic.
and on nearly every server things like:
sshd[13669]: connect from root@62.154.180.3
sshd[13669]: log: Could not reverse map address 62.154.180.3.
Well, just looks like a portscan. There are a lot fo them these
days. But I have a few old SuSE hosts here. I've upgraded the
installed SSH with the latest patches. Those hosts logged:
sshd[13669]: fatal: Local: Your ssh version is too old and is no
longer supported. Please install a newer version.
Is this just a message for some unsupported protocol version (or
if the scanner don't use any protocol string after connect)?
Or is it anything to worry about? (Yes, complete update is
already sheduled :))
Anyway, this may be a large scan which just hit my (small)
network.
Does anyone knows somethink about SSH-1.0-SSH_Version_Mapper?
BTW, merry chrismas and a happy new year.
oki,
Steffen
-- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
- Previous message: Sparro, Dave: "RE: *MAJOR SECURITY BREACH AT CCBILL**"
- Next in thread: Sebastian Jaenicke: "Re: some "scanned with SSH-1.0-SSH_Version_Mapper. Don't panic." in syslog"
- Reply: Sebastian Jaenicke: "Re: some "scanned with SSH-1.0-SSH_Version_Mapper. Don't panic." in syslog"
- Reply: Matthew D. Close: "Re: some "scanned with SSH-1.0-SSH_Version_Mapper. Don't panic." in syslog"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]