Code: p54 Severity: Warning
Description: This event is generated when a password of "wh00t" is used to login to an File Transfer Protocol (FTP) server. Impact: Remote root access. The attack may indicate that the FTP server has been compromised. Corrective: Examine the suspected compromised host for unauthorized changes. Make sure that the suspected compromised host has all security patches applied. Log activity to and from the suspected compromised host. Examine other systems on the network for evidence of compromise. If a compromised is discovered, reinstall the operating system.
|
