Subject: [LON-CAPA-dev] detecting and removing slapper....

From: Scott Harrison <[email-masked]>
Date: Tue, 17 Sep 2002 13:29:02 -0400

Dear All:

More information from 
http://www.f-secure.com/v-descs/slapper.shtml

REMOVAL 

  The worm is visible in the infected system as a process ".bugtraq". An
  infected system can be disinfected by
  terminating the worm's process, and by removing the files created into
  temporary directory: 

          /tmp/.uubugtraq
          /tmp/.buqtraq.c
          /tmp/.bugtraq

  The Apache web server must be shut down as well and the OpenSSL libary
  must be upgraded to a fixed
  version (0.9.6e or above) in order to avoid reinfection. 

Regards,
Scott

-- 
Scott Harrison, [email-masked]

---

From: Martin Siegert <[email-masked]>
Date: Tue, 17 Sep 2002 13:09:48 -0700

>   version (0.9.6e or above) in order to avoid reinfection. 

Just an addendum to avoid confusion: the latest RedHat packages mentioned in

http://rhn.redhat.com/errata/RHSA-2002-160.html

are patched against those vulneratbilities and are safe (despite the version
0.9.6b and earlier).

Cheers,
Martin

========================================================================
Martin Siegert
Academic Computing Services                        phone: (604) 291-4691
Simon Fraser University                            fax:   (604) 291-4242
Burnaby, British Columbia                          email: [email-masked]
Canada  V5A 1S6
========================================================================
> _______________________________________________
> LON-CAPA-admin mailing list
> [email-masked]
> http://mail.lon-capa.org/mailman/listinfo/lon-capa-admin