Very Computer

Today, in /var/log/messages of my RedHat 7.0 (+updates) box I found

Dec 21 11:26:26 xxx rpc.statd[361]: gethostbyname error for
^X??^X??^Y??^Y??^Z??^Z??^[??^[??%8x%8x%8x%8x%8x%8x%8x%8x%8x%236x%n%137x%n%10x%n%192x%n\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220
Dec 21 16:39:51 xxx kernel: Unable to load interpreter
/lib/ld-linux.so.2
Dec 21 16:39:51 xxx kernel: Unable to load interpreter
/lib/ld-linux.so.2
Dec 21 17:02:37 xxx kernel: Unable to load interpreter
/lib/ld-linux.so.2
Dec 21 17:02:37 xxx kernel: Unable to load interpreter
/lib/ld-linux.so.2
Dec 21 17:18:14 xxx kernel: VM: killing process xfs
Dec 21 17:18:14 xxx kernel: Unable to load interpreter
/lib/ld-linux.so.2
Dec 21 17:27:22 xxx kernel: Unable to load interpreter
/lib/ld-linux.so.2

the machine froze around Dec 21 20:30:00 (but was still 'ping'able this
morning). Could the rpc.statd message be an indication of a
buffer-overflow attack? Could the 'Unable to load interpreter
/lib/ld-linux.so.' error message be due to the buffer overflow being
successfull?

Thanks for any insight,

Kay
--
Kay Diederichs         http://strucbio.biologie.uni-konstanz.de/~kay

Fakultaet fuer Biologie, Universitaet Konstanz
Box M656, D-78457 Konstanz, Germany

following:

Quote:>the machine froze around Dec 21 20:30:00 (but was still 'ping'able this
>morning). Could the rpc.statd message be an indication of a
>buffer-overflow attack? Could the 'Unable to load interpreter
>/lib/ld-linux.so.' error message be due to the buffer overflow being
>successfull?

>Thanks for any insight,

When in doubt, pull it offline RIGHT AWAY.  That was a buffer overflow
attack.  My Honeypot was hit with the same one this morning, and the
cracker launched a short DoS attack.  Everything logged.  How sweet.

--
___________________________________________

    Mike Tr?tm?n
         http://www.troutman.org

Definate buffer overflow attempt.  Successful? Don't know. But...

Quote:> Dec 21 16:39:51 xxx kernel: Unable to load interpreter
> /lib/ld-linux.so.2

This error is about five hours later.

Quote:> Dec 21 17:18:14 xxx kernel: VM: killing process xfs

This is about 40 minutes after that one.  If you did not kill xfs, not good.

Quote:> Dec 21 17:18:14 xxx kernel: Unable to load interpreter
> /lib/ld-linux.so.2
> Dec 21 17:27:22 xxx kernel: Unable to load interpreter
> /lib/ld-linux.so.2

Look at your .bash_history for root and other system users.

Quote:> the machine froze around Dec 21 20:30:00 (but was still 'ping'able this
> morning). Could the rpc.statd message be an indication of a
> buffer-overflow attack?

It most assuredly is.

Quote:> Could the 'Unable to load interpreter
> /lib/ld-linux.so.' error message be due to the buffer overflow being
> successfull?

That is possible and you definatly should disconnect the machine from
the net at this point and check it out thoroughly.  These errors LOOK
to me like your cracker got in and was setting up something that broke
some of the system software.  Before taking the system off line, nmap
it from some other host.  Save that data.

--
Shortly after the 1967 Mideast War, a young girl asked Ms. Golda Meyer
when there would be peace in the middle east.  Ms. Meyer responded,
"There will never be peace in the middle east so long as we hate our
enemies more than we love our children."

It wasn't successful. Your system isn't vulnerable to the attack being
executed here.