| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1103650458.5021.72.camel@visse.cbn> From: ppatters at cbnco.com (Pamela Patterson) Subject: Possible apache2/php 4.3.9 worm On Tue, 2004-12-21 at 10:32, Alex Schultz wrote: > Some of the sites I administer were alledgedly hit by a worm last night. > It overwrote all .php/.html files that were owner writable and owned by > apache. The worm put the following html in place of what was there: > <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> > <HTML> > <HEAD> > <TITLE>This site is defaced!!!</TITLE> > </HEAD> > <BODY bgcolor="#000000" text="#FF0000"> > <H1>This site is defaced!!!</H1> > <HR> > <ADDRESS><b>NeverEverNoSanity WebWorm generation 17.</b></ADDRESS> > </BODY> > </HTML> > > We were running apache 2.0.52 and php 4.3.9. Have any of you encounted > this before? Also is there anything I should be aware of such as a > possible binary that may have been dropped? Could this have been > accomplised by the upload path traversal vulnerability? Google returns > nothing. It seems to be a worm exploiting a recent hole in PhPBB. http://groups.google.ca/groups?hl=en&lr=&safe=off&threadm=nrWdna_Pae7yNlrcRVn-gw%40comcast.com&rnum=1&prev=/groups%3Fhl%3Den%26lr%3D%26selm%3DnrWdna_Pae7yNlrcRVn-gw%2540comcast.com -- Pamela Patterson, B.Eng, GCFA Senior Systems Administrator Canadian Bank Note Company, Limited http://www.cbnco.com ------------------------------------------------------------------ There are two kinds of sysadmins: paranoids and losers. I'm both kinds. ------------------------------------------------------------------
Powered by blists - more mailing lists