Linux : Lion Worm Continues Rampage Posted by R@hUl | at 8:40 AM

The Lion worm has been found spreading itself across the Internet by exploiting a known vulnerability in BIND on Linux systems. Once the worm gains root permissions by exploiting BIND, it emails to a china.com address /etc/passwd, /etc/shadow, and some network settings; removes /etc/hosts.deny, installs back doors that listen on ports 60008 and 33567; stops syslogd; replaces login with a version with a back door; and installs the t0rn root kit.


The Lion worm then starts scanning random class B network ranges for its next victim. There are two known versions of the worm propagating across the Internet with only minor differences reported between them.

Read Full Articles From Here...