Provided by Aanval (Snort & Syslog Intrusion Detection and Correlation Engine) www.aanval.com
--
GEN:SID | 1:144 |
Message | FTP ADMw0rm ftp login attempt |
Summary | This event is generated when an FTP login by user "w0rm" was attempted. This is an account used by the ADMw0rm-v1 worm. |
Impact | Infected systems are left with a backdoor user account named "w0rm" and an email with the victims ip address is emailed to the worms creators. |
Detailed Information | This worm exploits a vulnerability in BIND version 4.9.6 and is linux specific. These attempts mean the box has probably already been compromised. |
Affected Systems | Default installations of RedHat 4.0 to 5.2 |
Attack Scenarios | Standard Internet worm. |
Ease of Attack | Simple. |
Corrective Action | Upgrade BIND on vulnerable servers. |
Additional References | Arachnids: http://www.whitehats.com/info/IDS01 |
Rule References | arachnids: 01 |
--
DID:472796
--
http://www.aanval.com/