Re: attack on apache

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

To: users@xxxxxxxxxxxxxxxx
Subject: Re: attack on apache
From: Jaco Kroon <jaco@xxxxxxxxx>
Date: Wed, 11 Jan 2012 22:10:50 +0200
Cc: Jeroen Geilman <jeroen@xxxxxxxxx>
In-reply-to: <4F0DE498.20400@adaptr.nl>
Reply-to: users@xxxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:8.0) Gecko/20111121 Thunderbird/8.0

On 11/01/12 21:35, Jeroen Geilman wrote:

In /var/log/httpd/error_log I see hink like this
sh: del comand no found
sh: xx Permission denied

I need help !

1. Stop apache.
2. investigate which leaky, creaky or lousy PHP script allowed this exploit.
3. remove the bad script.

4. Remount /tmp with noexec,nosuid,nodev to prevent the majority of these types of exploits.

It doesn't eliminate them, just prevents the majority of "canned" ones that I'm aware of.

JK

Follow-Ups:
- Re: attack on apache
  - From: Jeroen Geilman

References:
- attack on apache
  - From: Luisa Ester Navarro
- Re: attack on apache
  - From: Simone Caruso
- FW: attack on apache
  - From: Luisa Ester Navarro
- Re: FW: attack on apache
  - From: Tom Evans
- RE: attack on apache
  - From: Luisa Ester Navarro
- Re: attack on apache
  - From: Jeroen Geilman

Prev by Date: Re: attack on apache
Next by Date: Re: attack on apache
Previous by thread: Re: attack on apache
Next by thread: Re: attack on apache
Index(es):
- Date
- Thread

[Index of Archives] [Open SSH Users] [Linux ACPI] [Linux Kernel] [Linux Laptop] [Kernel Newbies] [Security] [Netfilter] [Bugtraq] [Squid] [Yosemite News] [MIPS Linux] [ARM Linux] [Linux Security] [Linux RAID] [Samba] [Video 4 Linux] [Device Mapper]