Bug 7985

As you will read below, not all of this report is specific to linux.
Linuxconf is however a key part of this security problem.  I'm sending this
to you such that you will, if you are not already, be aware of this problem
that many leaving linuxconf active, as it is by default, are open for
intrusion.
-----BEGIN HERE------------------------------------------------------------

From: Institutional Security Office <iso.edu>
Subject: URGENT: Attention all Unix and Network Administrators


Attention all Unix and Network Administrators,

The University of Utah Institutional Security Office has been noticing a
major influx in traffic, both inbound and outbound, looking for known
vulnerabilities in various Unix platforms.  This traffic increase has
resulted in the discovery of several Unix hosts on campus that have been
compromised and set up to act as a launching platform for a variety of
Denial of Service (DOS) attacks, via one or more of the following: SYN,
ICMP, SMURF, and UDP.  The known packages installed on these platforms are
one or more of the following hacks: BOB, trin00, and TFN. These packages
are true DOS packages, with the trin00 being the most elaborate.  The
potential of these packages running in parallel would bring any network to
a stand still, making the Morris worm look like a packet collision.

Since the end of July, we have been attempting to determine a machine
profile and fingerprint to assist in discovering machines that have been
compromised.  These attempts have been successful in many casees, but have
not, and will not, put an end to discovery of vulnerable machines.  In
early
December we became aware that previously discovered machines were part of
the distributed intruder tools trin00 and/or TFN.  We feel the clock may
run out at any time for widespread launch these tools, and we do not have
enough resources to identify, what is potentially several hundred, machines
on Campus that have been compromised.

We have a list of known daemons that are being hacked to acquire access to
a machine and have one or more of the distributed DOS packages installed.
If you are running any of these (unpatched) packages your machine has
probably already been compromised.

These known daemons are, but not limited to:
        nfsd
        sunrpc
        statd
        ttbdserved
        cmsd
        sadmind
        linux-config / tacnews
If you are running any of the above as distributed with your system, and
have not tripwired your binaries, you will need to look at your system.
Known trojaned programs include:
        inetd
        initd
        ls
        ps
        netstat
Known locations of DOS binaries include:
        /tmp/
        /usr/share/man/tmp
        /use/man/tmp
        /dev
        /proc
        various subdirectories like "...", ". ^H" dot-space-backspace.
Known DOS ports include:
        98              <-- Linux configuration port
        1337
        1524
        6969
        27665
        27444
        31335
In many cases crontab entries have been made to launch the DOS binaries.
The DOS binaries often are named 'ns', 'xterm', or other common UNIX
style name.

Please note the above information may not be complete.  If you find any
anomolies, please inform <iso.edu>.