[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PHPwestoz] are there any know php vulnerabilities around?

firepages.com.au wrote:

You running phpBB ? if so patch it (or FUD yourself up ...
http://fud.prohost.org)

Its unlikely to be a vunerability in PHP itself , more likely a PHP or PERL
application (phpBB && Awstats both recently compromised to this extent)

Regards,
Simon.


----- Original Message -----
From: "Sol Hanna" <sol@autonomon.net>
To: <PHPwestoz@lists.linux.org.au>
Sent: Wednesday, February 16, 2005 5:11 PM
Subject: [PHPwestoz] are there any know php vulnerabilities around?




Mondo bad news - my server just got cracked! >:o

The crack involved index.php files in all directories under the web root
being overwritten with an intelligent bit of cracker poetry thus:

"Noturnos Crimez... OwnZ yOu, By Lord Cha0s.. * Mais um Dia se
passa..tudo novo.. mais pq eu sempre me ferro? fiko triste.. e tudo por
causa de uma minina que eu amo d+... nossa.. eu daria tudo pra tela
comigo. nos meus braços abraçala , beijala.. pedir desculpas a ela..
nossa.. eu seria o cara mais feliz se vesse ela a ultima vez.. soh
queria dizer .. GISLAINE EU TI AMO! d+!!!!!"

Just a text file.

That seems to be the extent of the damage, though I'm still quite pissed
off. Given that it has only affected index.php files in this way, it
seems that a PHP vulnerability is to blame. Anyone know anything about
this so I know how to take action to prevent it?????



Thanks for this tip Simon. I know that I'm not using a vulnerable version of phpBB because I was aware of the flaw in phpBB and was using a more recent version (2.0.11) that wasn't vulnerable. BUT I am using a vulnerable version of AwStats. I found out about it simply by Googling. There's an interesting article here:
http://it.slashdot.org/article.pl?sid=05/02/08/1834203&tid=172&tid=156

It points to how phpBB can be attacked from perl. The very sad part of this story is that last night I noticed when I ran 'top' on my server that perl was using over 90% of cpu. I thought, "that's odd, there's no cron jobs scheduled for this time of night." so i killed the process and thought nothing more of it.

silly me. :-[

thankyou also to Leon. you've raised a lot of points that i want to look at more closely. i've been getting a bit lack about permissions, etc and this is the wake up call i needed to have a good review of what's going on. and thanks to you i've got a good starting point of reference.

thanks guys; sol :-)