Utok na imap (long)

[Robert Drozda]

David Šauer wrote:
> 
> Zdravim vsechny,
>   videl jsem pomerne podivnou hlasku v logu. Mohl by mi nekdo strucne
>   vysvetlit, o co se nekdo pokousel a co tim sledoval - osobne bych
>   odhadl buffer overflow, ale co tim dany clovek sledoval ?
>                                                
> Feb 26 20:26:28 gate imapd[3421]: System break-in attempt, host=[203.228.89.1]
> Feb 26 21:26:28 gate
> Feb 26 21:26:28 gate syslogd: Cannot glue message parts together
> Feb 26 21:26:28 gate 22>Feb 26 20:26:28 imapd[3421]: AUTHENTICATE ^P^P^P^P^P^P^P


> 
> Imap je imap-4.1.BETA-11 z RH5.1.
=====================================
A to je ten problem. Pred nekolika mesici byl nas server napaden presne
timto zpusobem. (je to buffer overflow attack) utocnik ziskal roota,
nainstaloval backdoor a "opatchoval" mi nekolik programu vcetne ps a ls.
 
Upgradujte IMAP

robert drozda