TRG vger.timpanogas.org hacked

[Jeff V. Merkey]

Our master server (vger.timpanogas.org) running 2.2.19 was hacked and 
completely obliterated by someone using a Novell Proxy Cache via a kernel
level exploit in [sys_wait+4].  They somehow created a segmentation fault 
down inside the kernel, then gained access to the /lib directory and 
relinked the libraries to a set of bogus libs, which gave them 
access to the server.  Only public code and email is processed on 
this server.  

For those interested in reviewing this attack, I have the entire previous
hard disk available and can mount it under the public ftp area if anyone 
is curious as to how these folks did this.  They exploited BIND 8.2.3
to get in and logs indicated that someone was using a "back door" in 
Novell's NetWare proxy caches to perform the attack (since several 
different servers were used as "blinds" to get in).  

We are unable to determine just how they got in exactly, but they 
kept trying and created an oops in the affected code which allowed 
the attack to proceed.  

Jeff