Experimental Physics and
Industrial Control System

"Jeff Hill" <[email protected]> · Fri, 28 May 2004 15:11:11 -0600

Hopefully, none of our colleagues have exported the port of a CVS server
through their firewall. An example setup which might be likely to experience
malicious abuse would be allowing direct read only anonymous access to a CVS
server. See attached.

Jeff

>>-----BEGIN PGP SIGNED MESSAGE-----
>>
>>A DOE site reported that one of their systems was quite likely 
>>compromised through a recently announced CVS vulnerability. They 
>>discovered this because a second DOE site reported seeing probes for 
>>the vulnerability by several foreign IP addresses. Those IP addresses 
>>and the UTC times that were seen at the second site
>>are:
>>
>>May 23 17:43:29 62.87.235.95
>>May 23 19:03:24 217.96.8.158
>>May 23 20:09:53 217.120.30.217
>>May 23 20:24:35 218.42.151.179 *
>>May 23 20:49:28 80.139.250.197 *
>>May 24 10:53:41 82.149.228.89 *
>>May 24 10:59:04 82.149.228.89 *
>>May 24 13:42:48 213.149.96.50
>>May 24 14:11:09 217.120.30.217
>>May 24 16:34:46 62.80.126.39
>>
>>
>>The three IP addresses with "*" were also seen on the compromised 
>>system at the first DOE site. The second site also reported that the 
>>sequence of CVSROOT directories tried is precisely the sequence in the 
>>exploit code which can be seen at
>>
>>http://packetstormsecurity.nl/0405-exploits/cvs_linux_freebsd_HEAP.c
>>
>>CIAC suggests that the DOE sites look for suspicious connections with 
>>these and other IP addresses to their CVS servers. Vulnerable servers 
>>can be patched according to CIAC Bulletin O-147: Linux CVS Server Heap 
>>Overflow Vulnerability.
>>
>>
>>
>>________________________________________________________________________
>>                The Computer Incident Advisory Capability
>>                           ___ __ __   _    ___
>>                          /      |    / \  /
>>                          \___ __|__ /___\ \___ 
>>______________________________________________________________________

Jeff
__________________________________________________________
Jeffrey O. Hill               Mail         [email protected]
LANL MS H820                  Voice        505 665 1831
Los Alamos NM 87545 USA       Fax          505 665 5107

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System