[ILUG] Linux worm exploiting BIND

[James Raftery]

Summary:
http://www.sans.org/y2k/lion.htm

"The Consensus Intrusion Database (CID) hosted on CID confirms that FTP,
TCP port 21 has been the most attacked port in the last ten days, but in
the past 48 hours there has been a 1000% increase in reported attacks on
DNS port 53 TCP, 45,000 reports (out of 51,000) of them coming from a
single IP address 200.239.59.252."

http://www.sans.org/y2k/032201-1700.htm
http://www.sans.org/y2k/032301-0915.htm

james
-- 
James Raftery (JBR54)
  "It's somewhere in the Red Hat district"  --  A network engineer's
   freudian slip when talking about Amsterdam's nightlife at RIPE 38.