We have recntly suffered an attack under this exploit, and disabled the our phpBB (Buletin
Board). Although I understand the attack came in through a XML-PHP exploit, I can't find
anything that tells me exactly what needs to be updated.
This is a RHL 7.2 server.
reference this article:
http://isc.sans.org/diary.php?storyid=823
We had 12 perl scripts running under the apache username. They each were running a script
located in the /tmp folder. And created a very healthy list of other php pages (mostly
buletin boards and group forums). It total killed our trunk line, 110% saturation.
Anyone familiar with this attack?? It is a very cripling attack and I am surprised I did
not find more information about it.
it was br0k3d whose name was on the script file. The system itself wasn't comprised
because apache is very limited on which folders it can enter and permissions it has. Near
as I can tell the exploit allowed a user to download a script file using http protocol and
save it to the /tmp fold. Then the exploit told apache to run /usr/bin/perl
/tmp/nameofscriptfile that is when the fun began.
Another good reason *not* to setup a webserver as root or even a super user.
--
robert
--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
