[conspire] linux antivirus?  Blue Boar BlueBoar at thievco.com
Thu Sep 11 18:37:49 PDT 2003  Rick Moen wrote:  > (FYI, dates
cited for the 1i0n and lpdw0rm appearances refer to the >
_first_ versions of each, per my googling.  That googling is not
> guaranteed infallible:  I didn't exactly do a major research
project on > this stuff.) > OK, we're talking about poorly
maintained Red Hat boxes again; I can > tell.  How?  Because
this was a canned 'sploit in April 2001, targeted > almost
entirely at Red Hat 7.0 boxes still running a ridiculously >
long-vulnerable version of lprng.  (lprng is a slightly revised
version > of the crufty old BSD lpr print daemon.)  Those were
both Red Hat-specific, in that the flavors of shellcode used
would only work on Red Hat.  (If memory servers at all, the vuln
affected a  couple of other distros, too.)  > obsoletely
designed[1] print daemon, but also leave it accessible from >
the global Internet?  I can think of three answers: 1) That's
the way it installed out of the  box,