Re: Rooted through in.identd on Red Hat 6.0

[jhorner () KNOXLUG ORG (J. J. Horner)]

On Wed, 19 Apr 2000, Del Elson wrote:

> Hi,
>
> A client was hacked last week by what looked like a buffer
> overflow through in.identd.  This was on a Red Hat 6.0
> box.
>
> RH don't have any current security notices or fixes for
> in.identd on their servers, and I haven't seen other
> boxes hacked through in.identd recently.
<snip>
> Anyone know of any current bug notices, exploits, or
> patches for in.identd?
>
> Del

Well, he could have gotten in somewhere else and just put the backdoor in
identd.  I've had people get in on nameservers with old versions of BIND,
then backdoor another service.

Jon

--
J. J. Horner
Apache, Perl, Unix, Linux
jhorner () knoxlug org http://www.knoxlug.org/