GEN:SID | 1:144 |
Message | FTP ADMw0rm ftp login attempt |
Summary | This event is generated when an FTP login by user "w0rm" was attempted. This is an account used by the ADMw0rm-v1 worm.
|
Impact | Infected systems are left with a backdoor user account named "w0rm" and an email with the victims ip address is emailed to the worms creators.
|
Detailed Information | This worm exploits a vulnerability in BIND version 4.9.6 and is linux specific. These attempts mean the box has probably already been compromised.
|
Affected Systems | Default installations of RedHat 4.0 to 5.2
|
Attack Scenarios | Standard Internet worm.
|
Ease of Attack | Simple.
|
Corrective Action | Upgrade BIND on vulnerable servers.
|
Additional References | Arachnids: http://www.whitehats.com/info/IDS01
|
Rule References | arachnids: 01
|