[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: [Full-Disclosure] New Blaster variant using UDP port 1038?
- To: full-disclosure@lists.netsys.com
- Subject: RE: [Full-Disclosure] New Blaster variant using UDP port 1038?
- From: "Stahlkrantz, Mats (Mats)" <mstahlkrantz@lucent.com>
- Date: Thu, 14 Aug 2003 14:55:19 -0400
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1170" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=312445418-14082003><FONT face=Arial color=#0000ff size=2>Never
mind. Different issue causing this.</FONT></SPAN></DIV>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Stahlkrantz, Mats (Mats)
[mailto:mstahlkrantz@lucent.com]<BR><B>Sent:</B> Thursday, August 14, 2003
1:48 PM<BR><B>To:</B> full-disclosure@lists.netsys.com<BR><B>Subject:</B>
[Full-Disclosure] New Blaster variant using UDP port
1038?<BR><BR></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=644224617-14082003>We're starting to
see exploit attempts that are followed by probes from the infected host on
tcp/4444, and then UDP/1038. Has anyone else seen
this?</SPAN></FONT></DIV></BLOCKQUOTE></BODY></HTML>