Re: Attempts to push spam through apache

Same thing happening with a client of mine, but with hundreds of different 
clients. we had mod_proxy enabled there, but disabling it didn't helped at 
all.

I was forced to shutdown apache. it's the 1.3.27 version that came with SuSE 
9.1, with all the updates it continues being 1.3.27.

I know there are other, newer apache versions, but SuSE doesn't have them. I 
disabled apache until the client authorizes the fix proposed (upgrade from 
sources).

I surf the web for this vulnerability but nothing found.

Is anybody aware of this?

Regards
Gabriel


El Jue 19 Ago 2004 8:26 PM, Peter H. Lemieux escribió:
> My apache logs are recently full of entries like these:
>
> 211.100.24.173 - - [19/Aug/2004:21:03:48 -0400] "CONNECT 208.17.33.40:25
> HTTP/1.0" 200 1844
>
> Obviously this is an effort to pump spam through my server to 208.17.33.40.
>   There are many other target addresses as well.
>
> If I telnet to port 80 and enter the HTTP command
>
> 	CONNECT 208.17.33.40:25 HTTP/1.0
>
> the server replies with the 1844-byte home page of this site, as indicated
> by the "200 1844" part of the log entry.  As far as I can tell, this means
> that these exploit attempts only get a web page in reply and are not able
> to push the spam through to the intended target.
>
> I don't have mod_proxy enabled or anything else that would enable proxying
> to work.  Are these just random spammer attempts to find an open proxy? 
> The fact that there are nearly 35,000 (!) such entries over the past few
> days suggests that the spammer, or the spammer's software, thinks this
> exploit is succeeding.  How can I be sure that it's not?
>
> I've blocked the 211.100.24.0/24 subnet for now, but I'd like to be certain
> that others can't use the same exploit.  I tried a variety of Google
> searches but haven't found a useful page to read on this subject.
>
> Some months ago someone used the recent mod_ssl vulnerability and managed
> to install an IRC proxy on this server.  However I fixed those problems at
> the time, and there's no evidence that any unauthorized programs, e.g.,
> proxies, are now running.  (No, there are no rootkits installed, nor is the
> ps binary compromised, etc.  I'm well aware of such possibilities.) 
> Perhaps the machine was just added to a list of potentially vulnerable
> servers, and someone else is trying to take advantage of me, even though
> it's no longer possible?
>
> FWIW, I'm running Apache 1.3.27 on RedHat 7.3, but I'd guess these types of
> exploits only work if there is an open http proxy available, no?
>
>
> Peter