[Dshield] port 554 activity

Johannes Ullrich jullrich at euclidian.com
Tue Oct 28 17:43:04 GMT 2003


On Tue, 2003-10-28 at 11:52, Bjorn Stromberg wrote:
> Some time last night we started getting hit with scans from all over the
> world for port 554.

You are the second person to point this out. Indeed, it
looks like we have an increase in this traffic:

http://isc.sans.org/port_details.html?port=554&repax=1&tarax=1&srcax=2&percent=N&days=40&Redraw=
(looks at the red line, number of sources)

This port is used by the Real Time Stream Control Protocol, which I
think is used by Realserver (Real Audio). There was a vulnerability in
this application a few months back and exploits for it have been widely
available.



--------------------------------------------------------------
Johannes Ullrich                     jullrich at euclidian.com
pgp key: http://johannes.homepc.org/PGPKEYS
--------------------------------------------------------------
   "We regret to inform you that we do not enable any of the 
    security functions within the routers that we install."
         support at covad.net
--------------------------------------------------------------





More information about the list mailing list