The CERT Coordination Center periodically issues the CERT Summary to draw attention to the types of attacks currently being reported to our incident response team. The summary includes pointers to sources of information for dealing with the problems. Since the last regularly-scheduled CERT Summary issued in May, we have seen the following trends in incidents reported to us.
Intruders continue to scan large blocks of network addresses for vulnerable systems.
Because we continue to receive reports of root compromises resulting from vulnerable versions of the IMAP server, we encourage you to take immediate action to address this vulnerability. Intruders are exploiting vulnerabilities addressed in previous CERT advisories, and using IP spoofing to hide the origin of the attacks. Each machine responding to the broadcast packet will generate an ICMP echo reply packet directed to the address of the original forged echo request packet. This can generate a large amount of traffic for the sites involved. If filtering broadcast packets at your router is not a viable option, you may be able to configure your operating system to ignore broadcast ICMP packets.