Full Disclosure mailing list archives
Re: Possible apache2/php 4.3.9 worm
From: Pamela Patterson <ppatters () cbnco com>
Date: Tue, 21 Dec 2004 12:34:18 -0500
On Tue, 2004-12-21 at 10:32, Alex Schultz wrote:
Some of the sites I administer were alledgedly hit by a worm last night. It overwrote all .php/.html files that were owner writable and owned by apache. The worm put the following html in place of what was there: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML> <HEAD> <TITLE>This site is defaced!!!</TITLE> </HEAD> <BODY bgcolor="#000000" text="#FF0000"> <H1>This site is defaced!!!</H1> <HR> <ADDRESS><b>NeverEverNoSanity WebWorm generation 17.</b></ADDRESS> </BODY> </HTML> We were running apache 2.0.52 and php 4.3.9. Have any of you encounted this before? Also is there anything I should be aware of such as a possible binary that may have been dropped? Could this have been accomplised by the upload path traversal vulnerability? Google returns nothing.
It seems to be a worm exploiting a recent hole in PhPBB. http://groups.google.ca/groups?hl=en&lr=&safe=off&threadm=nrWdna_Pae7yNlrcRVn-gw%40comcast.com&rnum=1&prev=/groups%3Fhl%3Den%26lr%3D%26selm%3DnrWdna_Pae7yNlrcRVn-gw%2540comcast.com -- Pamela Patterson, B.Eng, GCFA Senior Systems Administrator Canadian Bank Note Company, Limited http://www.cbnco.com ------------------------------------------------------------------ There are two kinds of sysadmins: paranoids and losers. I'm both kinds. ------------------------------------------------------------------ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Possible apache2/php 4.3.9 worm Alex Schultz (Dec 21)
- Re: Possible apache2/php 4.3.9 worm Pamela Patterson (Dec 21)
- Re: Possible apache2/php 4.3.9 worm Paul Schmehl (Dec 21)
- Re: Possible apache2/php 4.3.9 worm Ron Brogden (Dec 21)
- Re: Possible apache2/php 4.3.9 worm Brendan Dolan-Gavitt (Dec 21)
- Re: Possible apache2/php 4.3.9 worm DanB UK (Dec 22)
- Re: Possible apache2/php 4.3.9 worm Barrie Dempster (Dec 22)
- Re: Possible apache2/php 4.3.9 worm dk (Dec 22)
- Re: Possible apache2/php 4.3.9 worm DanB UK (Dec 23)
- Re: Possible apache2/php 4.3.9 worm dk (Dec 27)
- Re: Possible apache2/php 4.3.9 worm milw0rm Inc. (Dec 22)