Re: NeverEverNoSanity WebWorm???????

2004-12-21 Thread Andrea Vettorello
On Tue, 21 Dec 2004 00:23:02 -0600, Ron Johnson [EMAIL PROTECTED] wrote: On Tue, 2004-12-21 at 11:43 +1300, Simon Buchanan wrote: [snip] this is wierd, you cant ssh into the box. its got pureftpd/apache/php/mysql running on it. with only ftp/http ports open, all else firewalled out

Re: NeverEverNoSanity WebWorm???????

2004-12-21 Thread BigCoupe
I got hit myself. I believe I have narrowed it down to an exploited PHP as well as phpBB. BigCoupe -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]

Re: NeverEverNoSanity WebWorm???????

2004-12-21 Thread Florian Ernst
Hello! On Tue, Dec 21, 2004 at 07:15:58AM -0800, BigCoupe wrote: I got hit myself. I believe I have narrowed it down to an exploited PHP as well as phpBB. Apparently it's only a bug in phpBB, a fix is known for some time, see http://www.phpbb.com/phpBB/viewtopic.php?f=14t=240513 or update to

NeverEverNoSanity WebWorm???????

2004-12-20 Thread Simon Buchanan
Hi, A little over an hour ago.. all our PHP and HTML files got changed to this on my little develpoment box: !DOCTYPE HTML PUBLIC -//IETF//DTD HTML 2.0//EN HTMLHEAD TITLEThis site is defaced!!!/TITLE /HEADBODY bgcolor=#00 text=#FF H1This site is defaced!!!/H1 HR ADDRESSbNeverEverNoSanity

Re: NeverEverNoSanity WebWorm???????

2004-12-20 Thread Roberto Sanchez
Simon Buchanan wrote: Hi, A little over an hour ago.. all our PHP and HTML files got changed to this on my little develpoment box: !DOCTYPE HTML PUBLIC -//IETF//DTD HTML 2.0//EN HTMLHEAD TITLEThis site is defaced!!!/TITLE /HEADBODY bgcolor=#00 text=#FF H1This site is defaced!!!/H1 HR

Re: NeverEverNoSanity WebWorm???????

2004-12-20 Thread Ron Johnson
On Tue, 2004-12-21 at 11:43 +1300, Simon Buchanan wrote: [snip] this is wierd, you cant ssh into the box. its got pureftpd/apache/php/mysql running on it. with only ftp/http ports open, all else firewalled out So, either: a) there's a root-exploitation bug in pureftpd b) there's a