Bugtraq mailing list archives
Fw: CERT Summary CS-99.04
From: bsehmel () NARROWS COM (Sehmel, William C.)
Date: Wed, 24 Nov 1999 00:39:02 -0800
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CERT Summary CS-99-04 November 23, 1999 Each quarter, the CERT Coordination Center (CERT/CC) issues the CERT summary to draw attention to the types of attacks reported to our incident response team, as well as other noteworthy incident and vulnerability information. The summary includes pointers to sources of information for dealing with the problems. Past CERT summaries are available from http://www.cert.org/summaries/ ______________________________________________________________________ Reminder: New CERT/CC PGP Key On October 4, 1999, the PGP key for the CERT/CC was replaced with a new PGP key. For more information, see http://www.cert.org/contact_cert/encryptmail.html ______________________________________________________________________ "CERT/CC Current Activity" Web Page The CERT/CC Current Activity web page is a regularly updated summary of the most frequent, high-impact types of security incidents and vulnerabilities currently being reported to the CERT/CC. It is available from http://www.cert.org/current/current_activity.html The information on the Current Activity page will be reviewed and updated as reporting trends change. ______________________________________________________________________ Year 2000 (Y2K) Information The CERT/CC has published information regarding the Y2K problem: Y2K Information http://www.cert.org/y2k-info/ ______________________________________________________________________ Recent Activity Since the last CERT summary, issued in August 1999 (CS-99-03), we have published advisories on WU-FTPD, BIND, CDE, and AMD. We have also analyzed and published information regarding distributed intruder tools. Among other activity, we continue to see widespread scans for known vulnerabilities. 1. Distributed Intruder Tools Denial of Service We have received reports of intruders compromising machines in order to install distributed systems used for launching packet flooding denial-of-service attacks. The systems typically contain a small number of servers and a large number of clients. These reports indicate that machines participating in such distributed systems are likely to have been root compromised. You can find more information in CERT Incident Note 99-07 http://www.cert.org/incident_notes/IN-99-07.html Sniffer We have received reports of intruders using distributed network sniffers to capture usernames and passwords. The distributed sniffer consists of a client and a server portion. As of this summary, the sniffer clients have been found exclusively on compromised Linux hosts. For more information please see CERT Incident Note 99-06 http://www.cert.org/incident_notes/IN-99-06.html 2. CDE Vulnerabilities Multiple vulnerabilities have been identified in some distributions of the Common Desktop Environment (CDE). These vulnerabilities are different from those discussed in CA-98.02 and can lead to intruders gaining root access on vulnerable systems. For more information please see CERT Advisory CA-99-11 http://www.cert.org/advisories/CA-99-1-CDE.html 3. BIND Vulnerabilities Several vulnerabilities have been found in BIND, the popular domain name server from the Internet Software Consortium (ISC). One of these vulnerabilities may allow remote intruders to gain privileged access to name servers. The others can severely disrupt the operation of the name server. For more information, please see CERT Advisory CA-99-14 http://www.cert.org/advisories/CA-99-14-bind.html 4. WU-FTPD Vulnerabilities Three vulnerabilities have been identified in WU-FTPD and other ftp daemons based on the WU-FTPD source code. WU-FTPD is a common package used to provide File Transfer Protocol (FTP) services. Remote and local intruders may be able to exploit these vulnerabilities to execute arbitrary code as the user running the ftp daemon (usually root). Incidents involving the first of these three vulnerabilities have been reported to the CERT Coordination Center. For more information please see CERT Advisory CA-99-13 http://www.cert.org/advisories/CA-99-13-wuftpd.html 5. AMD Vulnerabilities There is a buffer overflow vulnerability in the logging facility of the amd daemon. This daemon automatically mounts file systems in response to attempts to access files that reside on those file systems. Remote intruders can exploit this vulnerability to execute arbitrary code as the user running the amd daemon (usually root). For more information see CERT Advisory CA-99-12 http://www.cert.org/advisories/CA-99-12-amd.html We have received reports regarding exploits of this vulnerability. For more information please see CERT Incident Note 99-05 http://www.cert.org/incident_notes/IN-99-05.html 6. RPC Vulnerabilities We continue to receive reports of exploitations involving three RPC vulnerabilities: rpc.cmsd, ttdbserverd, and statd/automountd. These exploitations can lead to root compromise on systems that implement vulnerable RPC services. Analysis has shown that similar artifacts have been found on compromised systems. For more information on the vulnerabilities please see CERT Incident Note 99-04 http://www.cert.org/incident_notes/IN-99-04.html CERT Advisory CA-99-08 http://www.cert.org/advisories/CA-99-08-cmsd.html CERT Advisory CA-99-05 http://www.cert.org/advisories/CA-99-05-statd-automountd.html CERT Advisory CA-98-11 http://www.cert.org/advisories/CA-98.11.tooltalk.html 7. Virus and Trojan Horse Activity We continue to see reports of virus activity. Current versions of anti-virus software can help to protect your systems from these viruses. It is important to take great caution with any email or Usenet attachments that contain executable content. If you receive a message containing attachments, scan the message file with anti-virus software before you open or run the file. Doing this does not guarantee that the contents of the file are safe, but it lowers your risk of virus infection by checking for viruses and Trojan horses that your scanning software can detect. CERT/CC has published a Virus Resources page that includes information on Frequently Asked Questions (FAQs) about Computer Viruses Hoax and Chain Letter Databases Virus Databases Virus Organizations and Publications Anti-Virus Vendors Virus Related Papers Please see Virus Resources http://www.cert.org/other_sources/viruses.html 8. Continued Widespread Scans We continue to receive reports of scanning and probing activity. The most frequent reports tend to involve services that have well-known vulnerabilities. Hosts continue to be affected by exploitation of well-known vulnerabilities in these services. sunrpc (TCP port 111) and mountd (635) http://www.cert.org/advisories/CA-98.12.mountd.html http://www.cert.org/incident_notes/IN-99-04.html IMAP (TCP port 143) http://www.cert.org/advisories/CA-98.09.imapd.html POP3 (TCP port 110) http://www.cert.org/advisories/CA-98.08.qpopper_vul.html DNS (TCP port 53 [domain]) http://www.cert.org/advisories/CA-98.05.bind_problems.html http://www.cert.org/advisories/CA-97.22.bind.html ______________________________________________________________________ What's New and Updated Since the last CERT summary, we have developed new and updated * Advisories * CERT statistics * Incident notes * Tech tips/FAQs * Y2K information There are descriptions of these documents and links to them on our "What's New" web page at http://www.cert.org/nav/whatsnew.html ______________________________________________________________________ This document is available from: http://www.cert.org/summaries/CS-99-04.html ______________________________________________________________________ CERT/CC Contact Information Email: cert () cert org Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 U.S.A. CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryption We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from http://www.cert.org/CERT_PGP.key If you prefer to use DES, please call the CERT hotline for more information. Getting security information CERT publications and other security information are available from our web site http://www.cert.org/ To be added to our mailing list for advisories and bulletins, send email to cert-advisory-request () cert org and include SUBSCRIBE your-email-address in the subject of your message. Copyright 1999 Carnegie Mellon University. Conditions for use, disclaimers, and sponsorship information can be found in http://www.cert.org/legal_stuff.html * "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office. ______________________________________________________________________ NO WARRANTY Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA+AwUBODsBglr9kb5qlZHQEQIvZACbBrc75HYvuxT/JZDa778JBH3eWcAAlR1S AFgkAYyLg3U8XXq5dhCRR0g= =Oqqs -----END PGP SIGNATURE-----
Current thread:
- Fw: CERT Summary CS-99.04 Sehmel, William C. (Nov 24)