Re: Ramen worm

[Tony Laszlo <laszlo@example.com>]

Here is an advisory concerning the worm and Linux. 

http://lwn.net/2001/0118

What do Turbolinux users need to upgrade to 
be safe? The ISSHO system is not connected 
to the net but during the telehodai hours, 
but better safe than sorry, no? 

I haven't found detailed information on that. 

Neither of the two Linux machines have 
anything connecting from outside of the 
LAN. However, both computers have NFS exports 
and occasionally connect to each other via ftp 
(not anonymous). 

(Linux client machine)
rpm -qa | grep nfs gives: 

knfsd-1.3-1
knfsd-clients-1.3-1
turbonetcfg-nfsexports-1.2.1-3

ps aux | grep nfs

  230 ?        SW     0:00 [nfsd]
  231 ?        SW     0:00 [nfsd]
  232 ?        SW     0:00 [nfsd]
  233 ?        SW     0:00 [nfsd]
  234 ?        SW     0:00 [nfsd]
  235 ?        SW     0:00 [nfsd]
  236 ?        SW     0:00 [nfsd]
  237 ?        SW     0:00 [nfsd]

rpm -qa | grep ftp gives: 
ftp-0.10-22
gftp-1.13-4
tftp-0.10-23
wu-ftpd-2.5.0-1


(Linux server)
rpm -qa | grep nfs gives: 
nfs-server-2.2beta47-1
knfsd-clients-1.3-2
turbonetcfg-nfsexports-1.2.1-4

ps ax | grep nfs
  305 ?        S     12:46 rpc.nfsd
 9649 ttyp0    S      0:00 grep nfs

rpm -qa | grep ftp gives: 
anonftp-2.6-1
ftp-0.10-22
ncftp-2.4.3-6
wuftpd-2.4.2-vr16-3
gftp-1.13-4

ps ax | grep ftp (when the client user is connecting)
 9654 ?        S      0:00 ftpd: asong.issho.org: connected: IDLE


Thanks! 


Tony Laszlo  Ｔ．ラズロ
Jiyugaoka, Tokyo  東京都目黒区
http://www.issho.org/laszlo.html