What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Discussion

Solaris worm...

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Post #1
FYI…

- http://isc.sans.org/diary.html?storyid=2316
Last Updated: 2007-02-27 22:52:41 UTC
"We have received a report today… pointing us to this article*… We checked our data here at the Storm Center and it appears we have similar traffic from the same net ranges. High number of targets, but low number of sources also reflects that. Check it out… - http://isc.sans.org/port.html?port=23 …"

* http://asert.arbornetworks.com/2007/02/sol…-possible-worm/
February 27th, 2007 ~ "…This is related to a recent Solaris bug, specifically CVE-2007-0882** (the telnet “-froot” bug)…"

** http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0882
Last revised: 2/15/2007…
CVSS Severity: 10.0 (High)
Range: Remotely exploitable
Authentication: Not required to exploit
Impact Type: Provides administrator access, Allows complete confidentiality, integrity, and availability violation , Allows disruption of service…"

:ph34r:
Post #4
FYI…

Solaris.Wanukdoor
- http://www.symantec.com/security_response/…-99&tabid=3
Updated: March 1, 2007
Also Known As: SunOS/Wanukdoor [McAfee]
Type: Trojan
"…Once the threat attacks a computer, it is difficult to determine what else the computer has been exposed to. In most cases, changes other than those made by the threat will not have occurred. However, the author of the threat may have been able to use the threat to access the computer to make changes to it. Unless you can be absolutely sure that malicious activity has not been performed on the computer, we recommend completely reinstalling the operating system."

:ph34r:
Post #5
More…

- http://www.symantec.com/enterprise/securit…elnet_worm.html
February 28, 2007 ~ "Soon after information was released about a vulnerability in the in.telnetd daemon in Solaris 10, Symantec's Deepsight monitoring system began to see spikes in port 23 traffic. Most of this traffic was due to people scanning for vulnerable systems. However, yesterday we saw a renewed spike in traffic that has been correlated to a worm known as Wanuk, which uses the vulnerability to spread… Once Wanuk is on the system, it drops an executable that creates a /bin/sh back door, which listens on port 32982/TCP. In addition, Wanuk's payload includes sending out system broadcast messages of creatively designed shout-outs to a variety of security researchers… This will only happen one-third of the time at noon on the 13th of the month if the threat starts between 1 am and 5 am. Those affected should ensure they have patched or disabled telnet as a workaround…"

(Graphics available at the URL above.)

> http://isc.sans.org/port.html?port=23

:ph34r: