Full Disclosure mailing list archives

RE: Possible apache2/php 4.3.9 worm

From: "Todd Towles" <toddtowles () brookshires com>
Date: Tue, 21 Dec 2004 13:03:04 -0600

There were several serious holes just released in 4.3.9 of PHP. That is
a possible attack vector from what you are saying. Get 4.3.10 of PHP for
sure. As far as what this does or what all it would do, someone needs to
get a good catch of it.

Anyone ready to setup a box? =)

-----Original Message-----
From: full-disclosure-bounces () lists netsys com 
[mailto:full-disclosure-bounces () lists netsys com] On Behalf 
Of Alex Schultz
Sent: Tuesday, December 21, 2004 9:32 AM
To: full-disclosure () lists netsys com
Cc: gentoo-security () lists gentoo org
Subject: [Full-disclosure] Possible apache2/php 4.3.9 worm

Some of the sites I administer were alledgedly hit by a worm 
last night.
It overwrote all .php/.html files that were owner writable 
and owned by apache.  The worm put the following html in 
place of what was there:
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">  <HTML>  
<HEAD>  <TITLE>This site is defaced!!!</TITLE>  </HEAD> <BODY 
bgcolor="#000000" text="#FF0000"> <H1>This site is 
defaced!!!</H1> <HR> <ADDRESS><b>NeverEverNoSanity WebWorm 
generation 17.</b></ADDRESS> </BODY> </HTML>

We were running apache 2.0.52 and php 4.3.9. Have any of you 
encounted this before?  Also is there anything I should be 
aware of such as a possible binary that may have been 
dropped?  Could this have been accomplised by the upload path 
traversal vulnerability?  Google returns nothing.

Thanks
-Alex Schultz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Current thread:

Re: Possible apache2/php 4.3.9 worm, (continued)
- - - Re: Possible apache2/php 4.3.9 worm DanB UK (Dec 23)
    - Re: Possible apache2/php 4.3.9 worm dk (Dec 27)
- Re: Possible apache2/php 4.3.9 worm Juan Carlos Navea (Dec 21)
  - Re: Possible apache2/php 4.3.9 worm milw0rm Inc. (Dec 22)
- Re: Possible apache2/php 4.3.9 worm Feher Tamas (Dec 21)
- Re: Possible apache2/php 4.3.9 worm Joe Stewart (Dec 21)
  - Re: Re: Possible apache2/php 4.3.9 worm morning_wood (Dec 22)
  - RE: Re: Possible apache2/php 4.3.9 worm Patrick Nolan (Dec 22)
  - Re: Re: Possible apache2/php 4.3.9 worm Max Valdez (Dec 23)
- RE: Possible apache2/php 4.3.9 worm Randal, Phil (Dec 21)
- RE: Possible apache2/php 4.3.9 worm Todd Towles (Dec 21)