A hack??? Problems with Slackware 8.1 ... starting October 1

olivia · 10-05-2002, 02:34 PM

It may be that my Slackware 8.1 loads have been hacked and that might account for the problems I've had since October 1.

Running on 3 machines:
Slackware 8.1
All posted security patches since June load...

Problem.... All web browsers report a problem referencing "globals.pl" when
the URL is a cgi-bin code.... all of them (5)
The gnome calendar program crashes.

Now all of these problems can be avoided by backing up the system clock to before October 1... I don't know that that is the exact date of problem appearance.

I suspect (in order)...... glibc-2.5.5
openssl-0.9.6e
openssh-3.4-p1
apache-1.3.26

All these were loaded as binary packages from the Slackware site and are
the very same packages that are currently posted there....

It could also be a problem in the Gnome-1.4 package... I'll load another
window program to test this... or in XFree86-4.2 and I'll not bother to backup
to XFree86-4.1.1 -- just live with the problems..

Olivia Jensen (olivia@transsexy.geophys.mcgill.ca)

Any wisdom???

Mara · 10-05-2002, 03:57 PM

Does it affect all machines?
Can you find files with strange dates (especially future ones)?

jetblackz · 10-06-2002, 01:02 PM

tripwire

whaase · 10-11-2002, 08:00 PM

What is tripwire anyways?

Walter.

neo77777 · 10-12-2002, 01:53 AM

It is a system integrity verifier and alert system, default instalaltion notifies you of any file on your system that was modified, timestamped, removed, renamed, etc.

Aussie · 10-17-2002, 08:47 AM

chkrootkit is an excellent tool for checking if there is a root kit installed on your box.