Re: [CentOS] I may have been rooted - but I may not!? FOLLOW UP

2009-01-26 Thread Nigel Kendrick
rooted - but I may not!? FOLLOW UP Nigel Kendrick wrote: > Just found ZK root kit. > > Any ideas on infection vector? > This is a Trixbox Server based on Centos, running kernel 2.6.18-53.1.4.el5 > SMP Not really saying anything about the vector, but that kernel has a local root

Re: [CentOS] I may have been rooted - but I may not!? FOLLOW UP

2009-01-26 Thread Ralph Angenendt
Nigel Kendrick wrote: > Just found ZK root kit. > > Any ideas on infection vector? > This is a Trixbox Server based on Centos, running kernel 2.6.18-53.1.4.el5 > SMP Not really saying anything about the vector, but that kernel has a local root exploit (google for 'vmsplice'). One of the reasons

Re: [CentOS] I may have been rooted - but I may not!? FOLLOW UP

2009-01-26 Thread Nigel Kendrick
Just found ZK root kit. Any ideas on infection vector? Ho hum _ From: centos-boun...@centos.org [mailto:centos-boun...@centos.org] On Behalf Of Nigel Kendrick Sent: Monday, January 26, 2009 11:01 AM To: 'CentOS mailing list' Subject: [CentOS] I may have been rooted - but I may not!?