On 19.09.06 14:23, Igor V. Ruzanov wrote: > I use Apache/1.3.28 web-server under FreeBSD 5.2.1-RELEASE within jail > environment. And there is some strange thing when i'm checking > http-processes by `ps lax': > > 80 69523 1 0 96 0 6148 1232 select SLsJ ?? 0:00.49 (httpd) > The string `80 83454 1 0 96 0 6148 1232 select SLsJ ?? > 0:00.49 (httpd)' > is confused me because i don't know what is the process (httpd) (it seems > to be there is parent process with PPID=1). And the following picture is > appearing when i do the `sockstat| grep http' command: > > www httpd 69523 5 tcp4 217.144.97.27:53407 84.19.182.61:6667 > Same process is in the string `www httpd 69523 5 tcp4 > 217.144.97.27:53407 84.19.182.61:6667'. Its not difficult to see that we > deal with tcp-connection to irc-server. > Could you please help me to anderstand such behaviour of Apache-server, is > it normal situation or maybe its a some vulnerability of my version of > Apache? It seems that someone abused a security bug in one of your webs/scripts -- Matus UHLAR - fantomas, uhlar@xxxxxxxxxxx ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Save the whales. Collect the whole set. --------------------------------------------------------------------- The official User-To-User support forum of the Apache HTTP Server Project. See <URL:http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx " from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|