Re: Fwd: bugtraq.c httpd apache ssl attack

[Dale Amon <amon@vnl.com>]

On Sat, Sep 14, 2002 at 01:41:06PM -0400, Noah L. Meyerhans wrote:

> There are two worms.  One is old, one is new.  The one at
> http://217.24.0.78/bugtraq.c.txt is the new one.  It communicates via
> UDP port 2002, though I'm not actually sure what data gets sent on that
> port.  The old worm used UDP port 2001, and showed up shortly after the
> original OpenSSL vulnerability in late July.  Its source is at
> http://dammit.lt/apache-worm/apache-worm.c

Ah, I wondered  what it was. I've been seeing that port getting battered upon 
since at least last night that I noticed.

Thanks for the info. I've blocked it going into an ISP I watch over.