Re: statd-exploit attack against RH 7.0

[Pavel Kankovsky <[EMAIL PROTECTED]>]

On Wed, 10 Jan 2001, Johan.Augustsson wrote:

> Jan 8 20:20:00 'system' some other event
> Jan 8 19:24:04 'system' rpc.statd[366]: gethostbyname error for ....
> Jan 8 20:25:00 'system' some other event

Hmm....are you sure rpc.statd's timezone is identical to the rest of the
system? This is exactly the sort of things that happen when syslogging
programs run with different TZ's (yes, this is one of the many warts
making syslog so ugly).

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."