Note that it is important to periodically recheck these files, as they can contain updated information that we receive after an advisory is published. Root compromise on systems that are unpatched or running old OS versions. Compromised user-level accounts that are leveraged to gain further access. These sniffers, used to collect account names and passwords, are frequently installed as part of a widely-available kit that also replaces common system files with Trojan horse programs. IP spoofing attacks We continue to receive several reports each week of IP spoofing attacks.
Intruders attack by using automated tools that are becoming widespread on the Internet.
Some sites incorrectly believed that they were blocking such spoofed packets, and others planned to block them but hadn't yet done so. NFS and NIS attacks, and automated tools to scan for vulnerabilities We receive weekly reports of intruders using automated tools to scan sites for hosts that may be vulnerable to NFS and NIS attacks. Intruders are continuing to exploit the rpc.ypupdated vulnerability to gain root access, and intruders are still exploiting widely known vulnerabilities in NFS to gain root access. The CERT Coordination Center has a new Web site. It includes information on Internet security and has a link to the CERT FTP archive.