Re: statd exploit ???

On Wednesday 30 October 2002 22:29, Sriram Newsgroups wrote:
> My honeypt recorded this packet. It looks to be a statd exploit (port
> 32768). I can't narrow it down to what exactly this exploit does or its
> nature.
>
> Here is the sample packet
>
> [snipped]
>

I think it's the statdx2 exploit - which as your packet dump shows is trying
to exploit a format string vulnerability in statd. This exploit is over two
years old now.... doesn't time fly !

-jamie.
Received on Oct 31 2002