SANS Lion Worm Protection
Source: SANS - Posted by Nick DeClario   
Intrusion Detection Lion is a new worm, that is very similar to the Ramen worm. However, this worm is much more dangerous and should be taken seriously. It infects Linux machines with the BIND DNS server running. It is known to infect BIND version(s) 8.2, 8.2-P1, 8.2.1, 8.2.2-Px. BIND 8.2.3-REL and BIND 9 are not vulnerable. The BIND vulnerability is the TSIG vulnerability that was reported back on January 29, 2001.. . . Lion is a new worm, that is very similar to the Ramen worm. However, this worm is much more dangerous and should be taken seriously. It infects Linux machines with the BIND DNS server running. It is known to infect BIND version(s) 8.2, 8.2-P1, 8.2.1, 8.2.2-Px. BIND 8.2.3-REL and BIND 9 are not vulnerable. The BIND vulnerability is the TSIG vulnerability that was reported back on January 29, 2001.

There have been reports, of another attack wave that started back in mid February. The log files we have recieve do indicate that there was indeed a limited attack back then. Thanks to your help, this latest attack wave was reported and we were able to act on your reports.

The Lion worm spread via an application called pscan. randb then generates random class B networks probing TCP port 53. Once it hits a system, it then checks to see if that system is vulnerable. If so it then exploits the system using the exploit called name. It then installs the t0rn rootkit.

Read this full article at SANS

Only registered users can write comments.
Please login or register.

Powered by AkoComment!