full-disclosure - Possible apache2/php 4.3.9 worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <86144ED6CE5B004DA23E1EAC0B569B580339EA63@isabella.herefordshire.gov.uk>
From: prandal at herefordshire.gov.uk (Randal, Phil)
Subject: Possible apache2/php 4.3.9 worm

http://www.viruslist.com/en/weblog

http://isc.sans.org/diary.php?date=2004-12-21

Cheers,

Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK  

> -----Original Message-----
> From: full-disclosure-bounces@...ts.netsys.com 
> [mailto:full-disclosure-bounces@...ts.netsys.com] On Behalf 
> Of Alex Schultz
> Sent: 21 December 2004 15:32
> To: full-disclosure@...ts.netsys.com
> Cc: gentoo-security@...ts.gentoo.org
> Subject: [Full-Disclosure] Possible apache2/php 4.3.9 worm
> 
> Some of the sites I administer were alledgedly hit by a worm 
> last night.
> It overwrote all .php/.html files that were owner writable 
> and owned by apache.  The worm put the following html in 
> place of what was there:
> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">  <HTML>  
> <HEAD>  <TITLE>This site is defaced!!!</TITLE>  </HEAD> <BODY 
> bgcolor="#000000" text="#FF0000"> <H1>This site is 
> defaced!!!</H1> <HR> <ADDRESS><b>NeverEverNoSanity WebWorm 
> generation 17.</b></ADDRESS> </BODY> </HTML>
> 
> We were running apache 2.0.52 and php 4.3.9. Have any of you 
> encounted this before?  Also is there anything I should be 
> aware of such as a possible binary that may have been 
> dropped?  Could this have been accomplised by the upload path 
> traversal vulnerability?  Google returns nothing.
> 
> 
> Thanks
> -Alex Schultz
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>