[Snort-users] Port 9704

Joe Matusiewicz joem at ...692...
Wed Nov 29 12:24:15 EST 2000


At 10:22 AM 11/29/00, Kai Moritz wrote:
>Hello again! (And Thank you for your help last time )
>I've detected a scan on Port 9704, but I can't find that port in
>/etc/services or on the trojan-lists I know!
>Dose anybody knows something special about that port?

It's a backdoor for an rpc.statd sploit.  A copy of the CERT advisory can 
be found at:

http://www.cert.org/advisories/CA-2000-17.html

-- Joe




More information about the Snort-users mailing list