On Fri, 19 Jan 2001 03:23, you wrote:
> that's good to know. I too hope that Mandrake has something to say about
> this.
Theres a fairly good analysis of the worm at
http://members.home.net/dtmartin24/ramen_worm.txt
Note a few key points.....
-It's targeted for RH 6.2 and 7.0
-It's using exploits that were several months old
-The involved applications have all had security updates when the race
conditions were revealed by both RH and MDK
-It's a fairly obvious rootkit (/usr/src/.poop)
- It actually closes the hole it came in on!!!
As ever...do your security updates and keep smiling
Andrew
