OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
[Full-Disclosure] RE: phpBB vulnerability/Santy.a (formerly Possible apache2/php 4.3.9 worm)

From: Alex Schultz (aschultzecho-inc.com)
Date: Tue Dec 21 2004 - 12:09:58 CST

Here's some more information on the worm.

I was hit from the following ip address: 216.71.84.71
(goliath4.primary-server.net)

Attached is the GET's pulled from our snort logs in the order they came
in.

> -----Original Message-----
> From: full-disclosure-bounceslists.netsys.com
> [mailto:full-disclosure-bounceslists.netsys.com] On Behalf Of Alex
> Schultz
> Sent: 21 December 2004 15:32
> To: full-disclosurelists.netsys.com
> Cc: gentoo-securitylists.gentoo.org
> Subject: [Full-Disclosure] Possible apache2/php 4.3.9 worm
>
> Some of the sites I administer were alledgedly hit by a worm last
> night.
> It overwrote all .php/.html files that were owner writable and owned
> by apache. The worm put the following html in place of what was
> there:
> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML> <HEAD>
> <TITLE>This site is defaced!!!</TITLE> </HEAD> <BODY
> bgcolor="#000000" text="#FF0000"> <H1>This site is defaced!!!</H1>
> <HR> <ADDRESS><b>NeverEverNoSanity WebWorm generation
> 17.</b></ADDRESS> </BODY> </HTML>
>
> We were running apache 2.0.52 and php 4.3.9. Have any of you encounted

> this before? Also is there anything I should be aware of such as a
> possible binary that may have been dropped? Could this have been
> accomplised by the upload path traversal vulnerability? Google
> returns nothing.
>
>
> Thanks
> -Alex Schultz
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html