This special edition of the CERT Summary highlights widespread, large-scale attacks that are occurring against news servers. INN is a commonly used software program for serving and managing news according to the NNTP protocol. This vulnerability allows remote users to execute arbitrary commands on the news server with the same privileges as the user-id that manages the news server. The exploitation involves a particular kind of message, known as a control message.
Intruders can construct and post control messages in such a way as to exploit the vulnerability.
Because of this, your site may have been compromised even if it was not specifically selected by an intruder. If we receive further information, we will update this advisory. We encourage sites that are running INN 1.5 or earlier to upgrade to INN 1.5.1 as soon as possible. The directory includes MD5 checksums for each patch. If these message IDs appear in your logs, it is highly likely that these control messages reached your news server.