RE: [fw1-wizards] TCP port 9704 anyone?

[MichaelD.Peterson (Exchange)]

TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED]  Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------

I don't know if anyone posted an answer to this.  The exploit is for Linux
boxes and is an rpc statd exploit

http://www.securityfocus.com/bid/1480

Hope it helps.

-----Original Message-----
From: Hoang Viet [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, October 10, 2000 3:36 PM
To: Jason Witty
Cc: netboss; ISS Mailing List; fw1-wizards
Subject: Re: [fw1-wizards] TCP port 9704 anyone?



TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED]  Contact [EMAIL PROTECTED] for help with any
problems!
----------------------------------------------------------------------------

i think that port is only used for trojan
be careful
cheers,
phonglan

Jason Witty wrote:

>
> You forgot http://www.wittys.com/files/all-ip-numbers.txt .  That
> particular port has been used in several rootkits, to set up a backdoor
> shell into a UNIX box.  Probably just someone scanning for rooted
machines.
>
> Jason
>
> At 03:14 PM 10/5/00 -0400, netboss wrote:
> >My network was recently IPHalfScanned for TCP port 9704.  My faithful
> references at
> >
> >http://www.isi.edu/in-notes/iana/assignments/port-numbers
> >http://www.onctek.com/trojanports.html
> >http://www.simovits.com/nyheter9902.html
> >http://www.tla.ch/TLA/NEWS/1999sec/19990517trojan.htm
> >
> >left me empty handed.  Does anyone have any idea what tcp 9704 is used
for?
> >
> >Thanks in advance.
> >
> >______________________________________________
> >FREE Personalized Email at Mail.com
> >Sign up at http://www.mail.com/?sr=signup
> >
> >
> >---------------------------------------------------------------------
> >This email came from the FireWall-1 Wizards Mailing List
> >To unsubscribe, e-mail: [EMAIL PROTECTED]
> >For more information, email: [EMAIL PROTECTED]
> >
> >
> >