Full Disclosure mailing list archives
RE: Possible apache2/php 4.3.9 worm
From: "Randal, Phil" <prandal () herefordshire gov uk>
Date: Tue, 21 Dec 2004 17:36:39 -0000
http://www.viruslist.com/en/weblog http://isc.sans.org/diary.php?date=2004-12-21 Cheers, Phil ---- Phil Randal Network Engineer Herefordshire Council Hereford, UK
-----Original Message----- From: full-disclosure-bounces () lists netsys com [mailto:full-disclosure-bounces () lists netsys com] On Behalf Of Alex Schultz Sent: 21 December 2004 15:32 To: full-disclosure () lists netsys com Cc: gentoo-security () lists gentoo org Subject: [Full-disclosure] Possible apache2/php 4.3.9 worm Some of the sites I administer were alledgedly hit by a worm last night. It overwrote all .php/.html files that were owner writable and owned by apache. The worm put the following html in place of what was there: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML> <HEAD> <TITLE>This site is defaced!!!</TITLE> </HEAD> <BODY bgcolor="#000000" text="#FF0000"> <H1>This site is defaced!!!</H1> <HR> <ADDRESS><b>NeverEverNoSanity WebWorm generation 17.</b></ADDRESS> </BODY> </HTML> We were running apache 2.0.52 and php 4.3.9. Have any of you encounted this before? Also is there anything I should be aware of such as a possible binary that may have been dropped? Could this have been accomplised by the upload path traversal vulnerability? Google returns nothing. Thanks -Alex Schultz _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Possible apache2/php 4.3.9 worm, (continued)
- Re: Possible apache2/php 4.3.9 worm dk (Dec 22)
- Re: Possible apache2/php 4.3.9 worm DanB UK (Dec 23)
- Re: Possible apache2/php 4.3.9 worm dk (Dec 27)
- Re: Possible apache2/php 4.3.9 worm milw0rm Inc. (Dec 22)
- Re: Re: Possible apache2/php 4.3.9 worm morning_wood (Dec 22)
- RE: Re: Possible apache2/php 4.3.9 worm Patrick Nolan (Dec 22)
- Re: Re: Possible apache2/php 4.3.9 worm Max Valdez (Dec 23)