[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: New exploit in Apache and FC3?

 --- Randall Shaw <fedora randallshaw com> wrote: 
> > On Sun, 2005-06-26 at 22:09 -0400, Mailing List
> Receiver wrote:
> >> Ever since we found and stopped a phishing site
> that had been planted
> >> on our server to run as the default site under
> Apache, we have been under
> >> constant attack.  Presumably, the perpretrators
> did not appreciate that
> >> we made their millions of scam emails
> ineffective.
> >> 
> >> So, today I just happen to get a feeling that I
> should check for rootkits.
> >> Sure enough, someone had a listener at port 3049
> and lsof showed the owner
> >> as being Apache.  More investigation shows the
> following in /tmp
> > 
> > *snip*
> > 
> > I'd be more inclined to guess that there actually
> is a hole in a web app
> > you are running - you are a hosting service,
> correct?
> > 
> > A lot of hacks are done through insecure hosting
> software - maybe cpanel
> > or something like that.
> We had a spammer hack in through apache on a redhat
> box a month ago. He got
> in through a clients installed/used phpBB board (of
> course). The spammer
> installed shv5 and proceeded to send out millions of
> emails, of which our
> courier server promptly rejected doing so, so no
> harm was REALLY done.
> Took a while to get rid of the files, as we had to
> backtrack through the
> install process of shv5. We canned all our clients
> use of phpBB and the
> machine has been clean since.
> Just our experiences, maybe of some help to you.
> -Randall Shaw
What means did you use to conclude that the exploit is
in FC3 or Apache?  You should go through your logs
properly and come back with how the intruders actually
got in. 

Judging by the rash nature you have used to conclude
thats its Apache or FC3 at fault i would not be
surprised if you were runnning phpbb 2.06, vulnerable
AWSTATS  or gallery software.

Fedora Core - The power of Open Source Now! Please search the archives and fedoraforum.org as the question is likely to have been asked before.

Captain Bubudiu

How much free photo storage do you get? Store your holiday 
snaps for FREE with Yahoo! Photos http://uk.photos.yahoo.com

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]