On Fri, Mar 23, 2001 at 10:03:50AM -0800, Peter Jay Salzman wrote:
> note that it sounds like you're safe if your system isn't running bind.
> bind (berkeley internet name domain) is an implementation of the DNS (domain
> name system) name serving protocols. i think some distributions come with
> it by default.
It appears that if you have installed the latest BIND updates you are safe.
Here's what Linux Weekly News (lwn.net/daily) says:
> New Linux worm sighted
> Security, March 23 (Friday)
>
> Here's an alert from SANS on the so-called "Lion worm"
> been recently sighted on the net. This worm takes
> the well-known holes in BIND (fixed by most distributors
> January) to break into new systems. At that point it does
> number of unpleasant things. Those who have applied their
> updates need not worry; the rest of you should probably do
> fairly soon. SANS has also posted a detection and removal
> (Thanks to Greg Bailey).
It doesn't mention which version is resistant, alas, but that info is
probably on SANS.
--
Henry House
OpenPGP key available from http://hajhouse.org/hajhouse.asc
PGP signature
