Full Disclosure mailing list archives

Re: Possible apache2/php 4.3.9 worm

From: Juan Carlos Navea <loconet () gmail com>
Date: Tue, 21 Dec 2004 13:21:38 -0500

There is some information regarding this here: 

http://www.pcpro.co.uk/news/67505/santya-sparks-messageboard-infection-epidemic.html


On Tue, 21 Dec 2004 07:32:20 -0800, Alex Schultz <aschultz () echo-inc com> wrote:

Some of the sites I administer were alledgedly hit by a worm last night.
It overwrote all .php/.html files that were owner writable and owned by
apache.  The worm put the following html in place of what was there:
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
 <HTML>
 <HEAD>
 <TITLE>This site is defaced!!!</TITLE>
 </HEAD>
<BODY bgcolor="#000000" text="#FF0000">
<H1>This site is defaced!!!</H1>
<HR>
<ADDRESS><b>NeverEverNoSanity WebWorm generation 17.</b></ADDRESS>
</BODY>
</HTML>

We were running apache 2.0.52 and php 4.3.9. Have any of you encounted
this before?  Also is there anything I should be aware of such as a
possible binary that may have been dropped?  Could this have been
accomplised by the upload path traversal vulnerability?  Google returns
nothing.

Thanks
-Alex Schultz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html



-- 
http://www.loconet.ca
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Current thread:

Possible apache2/php 4.3.9 worm Alex Schultz (Dec 21)
- Re: Possible apache2/php 4.3.9 worm Pamela Patterson (Dec 21)
- Re: Possible apache2/php 4.3.9 worm Paul Schmehl (Dec 21)
- Re: Possible apache2/php 4.3.9 worm Ron Brogden (Dec 21)
  - Re: Possible apache2/php 4.3.9 worm Brendan Dolan-Gavitt (Dec 21)
  - Re: Possible apache2/php 4.3.9 worm DanB UK (Dec 22)
    - Re: Possible apache2/php 4.3.9 worm Barrie Dempster (Dec 22)
    - Re: Possible apache2/php 4.3.9 worm dk (Dec 22)
    - Re: Possible apache2/php 4.3.9 worm DanB UK (Dec 23)
    - Re: Possible apache2/php 4.3.9 worm dk (Dec 27)
- Re: Possible apache2/php 4.3.9 worm Juan Carlos Navea (Dec 21)
  - Re: Possible apache2/php 4.3.9 worm milw0rm Inc. (Dec 22)
- <Possible follow-ups>
- Re: Possible apache2/php 4.3.9 worm Feher Tamas (Dec 21)
- Re: Possible apache2/php 4.3.9 worm Joe Stewart (Dec 21)
  - Re: Re: Possible apache2/php 4.3.9 worm morning_wood (Dec 22)
  - RE: Re: Possible apache2/php 4.3.9 worm Patrick Nolan (Dec 22)
  - Re: Re: Possible apache2/php 4.3.9 worm Max Valdez (Dec 23)
- RE: Possible apache2/php 4.3.9 worm Randal, Phil (Dec 21)
- RE: Possible apache2/php 4.3.9 worm Todd Towles (Dec 21)