sendmail worm

Article View: comp.mail.sendmail

Article #2944

Back to comp.mail.sendmail Previous Next

#2944

From: Jim Crammond
Date: Mon, 07 Nov 1988 10:47

11 lines
902 bytes

You may have heard of a virus that has attacked arpanet over the weekend.

I believe this is in fact a "worm" that exploits a hole in bsd4.3 related
sendmail which has been compiled with the debug option.

For details I suggest you read the RISKS digest V7 Issues 69 and 70.

A note for Sun users: the standard sendmail binary is not compiled with
the debug code and therefore is safe from this attack.

-Jim.

Technical Details

Message-ID: <15969.8811071047@sophocles.doc.ic.ac.uk>

Path:

arc1-ca.pugleaf.net!utzoo!utgpu!watmath!clyde!att!osu-cis!tut.cis.ohio-state.edu!mailrus!ames!amdcad!sun!pitstop!sundc!seismo!uunet!mcvax!ukc!strath-cs!glasgow!Jim

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!utzoo!utgpu!watmath!clyde!att!osu-cis!tut.cis.ohio-state.edu!mailrus!ames!amdcad!sun!pitstop!sundc!seismo!uunet!mcvax!ukc!strath-cs!glasgow!Jim
From: jac@doc.ic.ac.uk (Jim Crammond)
Newsgroups: comp.mail.sendmail,mail.uk-sendmail-workers
Subject: sendmail worm
Message-ID: <15969.8811071047@sophocles.doc.ic.ac.uk>
Date: 7 Nov 88 10:47:30 GMT
Sender: daemon@cs.glasgow.ac.uk
Lines: 11
Phone: 01-589 5111 ext 5065
X-mailer: mail gatewayed to news (mail-news 1.5a)