RE: Systems compromised with ShellBOT perl script - part 2

["Poof" <poof () fansubber com>]

Well, just so you know... Back a BACKUP of your suexec file before upgrading
httpd when you have plesk then just replace the file after upgrading with
your backup.

Then you'll be fine. Otherwise... You SHOULD leave qmail/etc alone when
having PSA. =/

~

> -----Original Message-----
> From: KEM Hosting [mailto:security () kemhosting com]
> Sent: Wednesday, October 20, 2004 10:02 AM
> To: incidents () securityfocus com
> Subject: RE: Systems compromised with ShellBOT perl script - part 2
>
> Yes, upgrading Apache should have been done awhile ago.  The obstacle
> there
> is that I'm using Plesk (virtual host web-control panel) which installs
> all
> their custom RPMs.  If you try to upgrade them with standard RPMs, bad
> thing
> tend to happen. I'm sure there's a way to upgrade, but last time I tried
> (qmail), things got botched badly.  Anyone have experience with Plesk?
>
> Thanks for the responses.
>
> Ed
>
> ________________________________________
> From: Dave [mailto:djm () mcoe k12 ca us]
> Sent: Wednesday, October 20, 2004 11:26 AM
> To: incidents () securityfocus com; security () kemhosting com
> Subject: Re: Systems compromised with ShellBOT perl script - part 2
>
> I have just a couple:
>
> This is from the httpd-2.0.46-40.ent change log, you'll note that most of
> these can be considered exploitable hacks, and each and every one of them
> applies to your current install of 32.ent
>
> - mod_dav_fs: security fix for indirect lock refresh (CAN-2004-0809)
> - mod_dav_fs: fix indirect lock handling on 64-bit platforms
> - add security fixes for CAN-2004-0747, CAN-2004-0786
> - mod_ssl: add security fix for CAN-2004-0751
> - split security fix for CAN-2004-0748 out from -sslio patch
> - merge ap_rgetline_core NUL-termination fixes from 2.0.5[01]
> - have -devel require httpd of same V-R
> - drop suexec minimum acceptable gid to 100 (#127667)
> - mod_ssl: security fix for overflow in FakeBasicAuth (CVE CAN-2004-0488)
>
> Those are just httpd, leaving out the kernel and php hack fixes.
>
> If you dont have it set automatically, you need to have up2date download
> and
> update manually once per day.  Judging by your current packages, you
> havent
> updated since March... This is not a good thing :(
>
>
> ----- Original Message -----
> From: security () kemhosting com
> To: incidents () securityfocus com
> Sent: Tuesday, October 19, 2004 10:04 PM
> Subject: re: Systems compromised with ShellBOT perl script - part 2
>
> This thread is a couple months old, but I'm having issues with this hack,
> found
> it in the archives and thought it'd be helpful if I 'resusitated' it. See
> bottom of email for rest of thread.
>
>
> Today, hackers used the ShellBOT perl script to bring down Apache and
> start
> up
> their IRC listener.  They (somehow) copied it into /tmp and executed it.
>  This
> confuses me because I have my /tmp directory mounted rw,noexec,nosuid.
> Does
> Perl somehow bypass this?
>
>
> While the script was running, I ran lsof and found that it had recursively
> accessed all my (virtual host) httpd logs (probably in an attempt to
> delete
> it's tracks = the reason I can't see how they copied the script into /tmp)
> which are owned by root.  this is also confusing since the process the
> script
> spawned was owned by user apache.
>
>
> Some info on my box:
> Redhat ES kernel 2.4.21-9.0.1.ELsmp
> httpd-2.0.46-32.ent
> php-4.3.2-11.ent
>
>
> Anyone have any ideas on how this can happen?  Mainly the executing of a
> script
> on a noexec mount!  Obviously I'm not a guru, so it's probably something
> simple
> - so please, share!
>
>
> Thanks,
> Ed
> <<<<<<<<<<<<<CUT>>>>>>>>>>>>>>>