Help with cgi script attack

[John Summerfield]

Knute Johnson wrote:
> I need some help finding the correct place to go to get specific 
> help. We have a script that uses sendmail to send form data to the 
> site owner. Last night somebody managed to use it to send thousands 
> of spam emails.  I need to find the right place to ask about the 
> script to determine exactly how the attack was accomplished so we can 
> fix the script.  Any direction would be greatly appreciated.
> 
> Thanks,
> 
> 
> 

If you don't know the wcript being used, read the apache logs.

Especially, read what logwatch has to say. I read daily about attempts 
to misuse my sites.


You could also use iptables to prevent outgoing email until you have 
identified and fixed the problem. Any inconvenience to your users is 
nothing compared with what happens when you're taken off the 'net.