Full Disclosure mailing list archives

RE: phpBB vulnerability/Santy.a (formerly Possible apache2/php 4.3.9 worm)

From: "Alex Schultz" <aschultz () echo-inc com>
Date: Tue, 21 Dec 2004 10:09:58 -0800

Here's some more information on the worm.

I was hit from the following ip address: 216.71.84.71
(goliath4.primary-server.net)

Attached is the GET's pulled from our snort logs in the order they came
in.

-----Original Message-----
From: full-disclosure-bounces () lists netsys com
[mailto:full-disclosure-bounces () lists netsys com] On Behalf Of Alex 
Schultz
Sent: 21 December 2004 15:32
To: full-disclosure () lists netsys com
Cc: gentoo-security () lists gentoo org
Subject: [Full-disclosure] Possible apache2/php 4.3.9 worm

Some of the sites I administer were alledgedly hit by a worm last 
night.
It overwrote all .php/.html files that were owner writable and owned 
by apache.  The worm put the following html in place of what was 
there:
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">  <HTML> <HEAD>  
<TITLE>This site is defaced!!!</TITLE>  </HEAD> <BODY 
bgcolor="#000000" text="#FF0000"> <H1>This site is defaced!!!</H1> 
<HR> <ADDRESS><b>NeverEverNoSanity WebWorm generation 
17.</b></ADDRESS> </BODY> </HTML>

We were running apache 2.0.52 and php 4.3.9. Have any of you encounted

this before?  Also is there anything I should be aware of such as a 
possible binary that may have been dropped?  Could this have been 
accomplised by the upload path traversal vulnerability?  Google 
returns nothing.


Thanks
-Alex Schultz


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Attachment: gets.txt
Description: gets.txt

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Current thread:

RE: phpBB vulnerability/Santy.a (formerly Possible apache2/php 4.3.9 worm) Alex Schultz (Dec 22)