FTP exploit?

Mon Mar 19 21:15:23 UTC 2001

On Mon, Mar 19, 2001 at 01:01:39PM -0800, Clayton Fiske wrote:

> Is there a (fairly) recent exploit for common ftp daemons going around
> lately? In the past several days, I've seen a very noticeable jump in
> the number of people attempting anonymous ftp logins. Typically I
> noticed it once or twice a week, and usually single attempts, but now
> they're coming in every few hours and they each make 4 attempts within
> a second (which is one per IP bound to the box I'm watching). It looks
> like it has to be some kind of script.
> 
> Anyone else seeing any noticeable increases like this?

My snort logs (on my home network) show at least one scan like that
every day, usually two or more.

Ben

-- 
Ben Beuchler                                           There is no spoon.
insyte at emt-p.org                                            -- The Matrix