|
Full Disclosure
mailing list archives
RE: Possible apache2/php 4.3.9 worm
From: "Randal, Phil" <prandal () herefordshire gov uk>
Date: Tue, 21 Dec 2004 17:36:39 -0000
http://www.viruslist.com/en/weblog
http://isc.sans.org/diary.php?date=2004-12-21
Cheers,
Phil
----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
-----Original Message-----
From: full-disclosure-bounces () lists netsys com
[mailto:full-disclosure-bounces () lists netsys com] On Behalf
Of Alex Schultz
Sent: 21 December 2004 15:32
To: full-disclosure () lists netsys com
Cc: gentoo-security () lists gentoo org
Subject: [Full-disclosure] Possible apache2/php 4.3.9 worm
Some of the sites I administer were alledgedly hit by a worm
last night.
It overwrote all .php/.html files that were owner writable
and owned by apache. The worm put the following html in
place of what was there:
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML>
<HEAD> <TITLE>This site is defaced!!!</TITLE> </HEAD> <BODY
bgcolor="#000000" text="#FF0000"> <H1>This site is
defaced!!!</H1> <HR> <ADDRESS><b>NeverEverNoSanity WebWorm
generation 17.</b></ADDRESS> </BODY> </HTML>
We were running apache 2.0.52 and php 4.3.9. Have any of you
encounted this before? Also is there anything I should be
aware of such as a possible binary that may have been
dropped? Could this have been accomplised by the upload path
traversal vulnerability? Google returns nothing.
Thanks
-Alex Schultz
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
 By Date 
By Thread
Current thread:
- Re: Possible apache2/php 4.3.9 worm, (continued)
Re: Possible apache2/php 4.3.9 worm Juan Carlos Navea (Dec 22)
Re: Possible apache2/php 4.3.9 worm Feher Tamas (Dec 21)
Re: Possible apache2/php 4.3.9 worm Joe Stewart (Dec 22)
RE: Possible apache2/php 4.3.9 worm Randal, Phil (Dec 22)
RE: Possible apache2/php 4.3.9 worm Todd Towles (Dec 22)
| 
