full-disclosure - RE: phpBB vulnerability/Santy.a (formerly Possible apache2/php 4.3.9 worm)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <685F5668BEFF12479A66F1204BF59BF1803F18@exchange.prv.echo-inc.com>
From: aschultz at echo-inc.com (Alex Schultz)
Subject: RE: phpBB vulnerability/Santy.a (formerly
	Possible apache2/php 4.3.9 worm)

Here's some more information on the worm.

I was hit from the following ip address: 216.71.84.71
(goliath4.primary-server.net)

Attached is the GET's pulled from our snort logs in the order they came
in.



> -----Original Message-----
> From: full-disclosure-bounces@...ts.netsys.com
> [mailto:full-disclosure-bounces@...ts.netsys.com] On Behalf Of Alex 
> Schultz
> Sent: 21 December 2004 15:32
> To: full-disclosure@...ts.netsys.com
> Cc: gentoo-security@...ts.gentoo.org
> Subject: [Full-Disclosure] Possible apache2/php 4.3.9 worm
> 
> Some of the sites I administer were alledgedly hit by a worm last 
> night.
> It overwrote all .php/.html files that were owner writable and owned 
> by apache.  The worm put the following html in place of what was 
> there:
> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">  <HTML> <HEAD>  
> <TITLE>This site is defaced!!!</TITLE>  </HEAD> <BODY 
> bgcolor="#000000" text="#FF0000"> <H1>This site is defaced!!!</H1> 
> <HR> <ADDRESS><b>NeverEverNoSanity WebWorm generation 
> 17.</b></ADDRESS> </BODY> </HTML>
> 
> We were running apache 2.0.52 and php 4.3.9. Have any of you encounted

> this before?  Also is there anything I should be aware of such as a 
> possible binary that may have been dropped?  Could this have been 
> accomplised by the upload path traversal vulnerability?  Google 
> returns nothing.
> 
> 
> Thanks
> -Alex Schultz
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: gets.txt
Url: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041221/bfe16c65/gets.txt