Security Hole In SNMP

wiredog writes: "From ZDNET comes the news that there is apparently a serious security flaw in the Simple Network Management Protocol, used to control routers and other network devices." An anonymous reader points to the CERT advisory as well.

Comments

We're getting hit hard

[Phibz]

I don't know how many of you are seeing this but in the last 5 days we've had several main machines hit including our main nfs home directory server. All Solaris 8 machines. :-(

We've noticed that all are from a group called "NSDAP" something like the Nazi propaganda arm of the Third Reich.

The files we've found left behind (hacker droppings) are /usr/lib/vold/nsdap which contains bunches about the group. /usr/bin/ls and all the other likely canidates, ps, find, su, ssh, sh, etc. are replaced. They ran a shell on port 77.
All logs and sniffer dumps etc. were emailed to angelz1578@usa.net

Rather juvenile in my opinion. Oh well its always something.

Trey