|
-
January 27th, 2005, 11:49 PM
#1
It's not a 0-day sploit...it just takes advantage of weak passwords. Check out below quotes taken from the Internet Storm Center (http://isc.incidents.org )
The bot uses the "MySQL UDF Dynamic Library Exploit". In order to launch the exploit, the bot first has to authenticate to mysql as 'root' user. A long list of passwords is included with the bot, and the bot will brute force the password.
Mitigation
This bot does not use any vulnerability in mysql. The fundamental weakness it uses is a week 'root' account. The following mitigation methods will prevent exploitation:
/edit:
doesnt look like they have snort sigs yet but you can create one probably easily from the info they provide.
enjoy
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|