Re: Systems compromised with ShellBOT perl script - part 2

[Thomas Hochstein <ml () ancalagon inka de>]

"Stephen J. Smoogen" schrieb:

> I would check to make sure that none of the
> PHP/perl/etc are defaulting to using /tmp as their "temp space" as
> that would avoid the noexec,nosuid.

To have a look at those Perl/PHP-scripts wouldn't hurt either; there
are enough remote code injection exploits to be found in more or less
standard PHP applications.

-thh