Re: /tmp/bob on compromised system

[Joseph Pingenot <jap3003 () ksu edu>]

Hey.

>         We recently had a solaris 7 box compromised.  We *think* that
> the crackers got initial access through the oracle account which has
> the default password :-(.

> From what I've read, a Bad Idea.  :/

> deleting was /tmp/bob, now that rings a bell in my memory but I can't

Searching Google for "bob exploit" returned the following page:
  http://www.false.net/ipfilter/2000_03/0129.html
  Alta Vista returned nothing new and this was sufficient, so
  I dropped it.

--
Joseph==============================================jap3003 () ksu edu
"A perfect firewall, as Marcus Ranum has commented, is actually
  a pair of wirecutters applied to ALL wires associated with the
  computer and network."  --Anton J Aylward, on the vuln-dev list