[Snort-users] New Worm Virus is in the wild

Kevin.Brown at ...1022... Kevin.Brown at ...1022...
Fri Mar 23 12:19:04 EST 2001

Alert from SANS, the LION worm (similar to Ramen) is now in the wild.



It uses vulnerable versions of BIND (8.2, 8.2-P1, 8.2.1, 8.2.2-Px and all
8.2.3-beta versions).  It installs the t0rn rootkit on a system and then scans
a random class B subnet trying to find more vulnerable systems to infect.

More information about the Snort-users mailing list