Linux worm

Howard Lowndes lannet at
Mon Sep 30 20:45:11 EST 2002

I think this might be a variant of the Linux Slapper worm.

I have reported it to AUSCERT but they have not got back to me.

Anyone running Apache SSl look for:


The only one that seems to do anything is /tmp/devnull which is trying to
do a DDoS to somewhere on dest port 443.

I can't find any info on this anywhere.  Does anyone have any ideas what
it is?

I have patched openssl to the latest from RH 0.9.6b-28

LANNet Computing Associates - Your Linux people
Contact detail at
"Flatter government, not fatter government." - me
 Get rid of the Australian states.
If electricity comes from electrons, does morality come from morons?

More information about the linux mailing list