RE: Real-world attacks on sendmail CA-2003-07 seen

Is there a snort signature out for this as of yet?

Barry W. Kokotailo RET/CSA/CSNA/CISSP
Information Technology Security Specialist Edmonton Public School Board
Off: 1-780-429-8592
Cell: 1-780-905-6204
PGP Fingerprint:
1024/6D66B30C
65 0A EF 1A 20 59 C7 FA 6D A2 AB 6C 76 22 2D 93 6D 66 B3 0C

-----Original Message-----
From: jlewis@lewis.org [mailto:jlewis@lewis.org] Sent: Friday, March 07, 2003 8:32 PM
To: Bennett Todd
Cc: incidents@securityfocus.com
Subject: Re: Real-world attacks on sendmail CA-2003-07 seen

On Fri, 7 Mar 2003, Bennett Todd wrote:

> We logged received msgs that triggered the truncator code this
> morning at about 3 in the morning, US/Eastern; three different
> attacks spread over two different MX hosts.

I've seen several of these too. Were yours from the same or similar hosts, or all from different sources?

 Jon Lewis *jlewis@lewis.org*|  I route
 System Administrator        |  therefore you are
 Atlantic Net                |  

<Pre>Lose another weekend managing your IDS? Take back your personal time.
15-day free trial of StillSecure Border Guard.</Pre> <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>

<Pre>Lose another weekend managing your IDS? Take back your personal time.
15-day free trial of StillSecure Border Guard.</Pre> <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A> Received on Mon Mar 10 15:05:13 2003

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek