On 3 Mar 2004, at 20:00, cobalt-security-request@xxxxxxxxxxxxxxx wrote:
Curious, this looks suspecious.. [root admin]# ls -la /usr/sbin/crond=20 -rwxr-xr-x 1 root root 26636 Feb 3 13:53 /usr/sbin/crond [root admin]#=20 I dont recall applying any patches to crond.. What should the normal one be, and where can I get it (for raq550)
I'm not sure, but you might want to go looking for a file called 'cli.c' just in case. One of our servers got attacked recently, and the contents of this cli.c file were compiled into crond with potentially nasty side-effects.
Best, Mark -- Mark Mitchenall, Standingwave Ltd (Complete Hosting and Development Services) Tel := +44 (0)20 8452 3031 Email := mark@xxxxxxxxxxxxxxxxxx mark@xxxxxxxxxxxxxx Home := http://www.standingwave.co.uk http://www.mitchenall.com