[Important] wormDefense responder

Brent Simmons Manila-Newbies@userland.com
Wed, 19 Sep 2001 13:26:18 -0700 (PDT)


The latest IIS worm is not harmful to Frontier or Radio servers -- except
in the sense that worm hits are additional traffic to your machine.

Today we release the wormDefense responder that traps these hits. It deals
with them quickly and efficiently, so there's the least impact on your
servers.

To get the new responder, update Frontier.root and/or Radio.root.

The code is based on Eric Soroos' codeRed4 responder, but renamed so we
can add additional defenses, if and when new worms appear.

The responder itself is stored at webserver.responders.wormDefense. The
address of the responder is placed at
user.webserver.responders.wormDefense. The number of worm hits received is
stored at user.webserver.stats.wormHits.

If you have questions or concerns, please post to the Frontier discussion
group or reply to this email.

For more (non-Frontier-specific) information about this attack, see:

http://www.superopendirectory.com/directory/4/events/emailEnclosureVirus

-Brent