Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
[Full-Disclosure] RE: phpBB vulnerability/Santy.a (formerly Possible apache2/php 4.3.9 worm)
From: Alex Schultz (aschultzecho-inc.com)
Date: Tue Dec 21 2004 - 12:09:58 CST
Here's some more information on the worm.
I was hit from the following ip address: 18.104.22.168
Attached is the GET's pulled from our snort logs in the order they came
> -----Original Message-----
> From: full-disclosure-bounceslists.netsys.com
> [mailto:full-disclosure-bounceslists.netsys.com] On Behalf Of Alex
> Sent: 21 December 2004 15:32
> To: full-disclosurelists.netsys.com
> Cc: gentoo-securitylists.gentoo.org
> Subject: [Full-Disclosure] Possible apache2/php 4.3.9 worm
> Some of the sites I administer were alledgedly hit by a worm last
> It overwrote all .php/.html files that were owner writable and owned
> by apache. The worm put the following html in place of what was
> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML> <HEAD>
> <TITLE>This site is defaced!!!</TITLE> </HEAD> <BODY
> bgcolor="#000000" text="#FF0000"> <H1>This site is defaced!!!</H1>
> <HR> <ADDRESS><b>NeverEverNoSanity WebWorm generation
> 17.</b></ADDRESS> </BODY> </HTML>
> We were running apache 2.0.52 and php 4.3.9. Have any of you encounted
> this before? Also is there anything I should be aware of such as a
> possible binary that may have been dropped? Could this have been
> accomplised by the upload path traversal vulnerability? Google
> returns nothing.
> -Alex Schultz
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
Full-Disclosure - We believe in it.
- text/plain attachment: gets.txt