Security Incidents mailing list archives
Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition
From: "Jeff Plewes" <plewes () gmail com>
Date: Wed, 23 Jan 2008 21:46:36 -0500
To clarify on some facts: - yes the box was burned (brand new hardware.. fresh install centos5, minimal packages).. Only the virtualhost data was migrated. - updates done via yum package manager with default sources - php compiled from source from ca3.php.net - there are about 40 customers on this box with virtualhosts - all machines behind the firewall on the public vlan are ours - DNS is also housed by us.. 1st and 2nd on Bind 9. 1) If restarting httpd temporarily(days) resolves the problem.. then DNS is not the issue. 2) No proxy servers between client where problem is noticed and server which is compromised. 3) If the problem existed before with another disto, php and apache version.... then it must be customer data which can be exploited remotely? Time to go through each customer and find the offender. -Jeff On Jan 23, 2008 5:11 PM, Florian Weimer <fw () deneb enyo de> wrote:
* Jeff Plewes:This issue was happening on the same box when It used to be apache 2.0.56, php 5.1.0 running redhat 9. upgrading the distribution, apache, php etc has so far not resolved the issue.It could be something afoul with the network on which the machine is located. Have you check this? For instance, does it provide proper L3 separation among different customers?
Current thread:
- DNS CACHE POISONING? - Our Portal is redirecting to our first competition ponchovaldes (Jan 22)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Stephen John Smoogen (Jan 22)
- Message not available
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Stephen John Smoogen (Jan 22)
- RE: DNS CACHE POISONING? - Our Portal is redirecting to our first competition AJ (Jan 22)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Graeme Fowler (Jan 22)
- Message not available
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Stephen John Smoogen (Jan 22)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Jeff Plewes (Jan 23)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Stephen John Smoogen (Jan 23)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Florian Weimer (Jan 23)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Jeff Plewes (Jan 23)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Mark Gottschalk (Jan 24)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Gary Baribault (Jan 23)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Eduardo Tongson (Jan 23)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Ronald van der Westen (Jan 25)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition dxp2532 (Jan 25)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Cedric Blancher (Jan 25)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Jeff Plewes (Jan 28)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Paul Schmehl (Jan 28)
- Re: DNS CACHE POISONING? - Our Portal is redirecting to our first competition Jeff Plewes (Jan 28)