North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Just an FYI - Apache Worm on the loose

  • From: Stephen J. Wilcox
  • Date: Wed Jul 10 18:34:23 2002

If you want to be proactive, filter this port across your backbone and you will
very quickly see what hosts have been compromised.. on the other hand individual
customers seem to use all their bandwidth so they tend to phone in pretty quick!

Steve


On Wed, 10 Jul 2002, Scott Francis wrote:

> On Tue, Jul 09, 2002 at 02:26:23PM -0700, [email protected] said:
> > There is an Apache worm out there, and it uses port 2001/udp to operate.  You
> > may wanna scan your own boxes for this open port.
> 
> Announced last week on BUGTRAQ and elsewhere.
> http://online.securityfocus.com/archive/1/279529
> 
> (and was it _really_ necessary to post a hex dump of the entire thing? The
> actual source is available linked from the BUGTRAQ post above ...)
>