Re: [Security-Discuss] Exploits

Hi Vince (& all),

I did manage to find the point of entrance; and you were right - it wasn't
mod_ssl.  It was someone's WebCalendar, which is quite a hole it seems unless
you're running the latest and greatest.

Yes, I did get the mod_ssl problem from that advisory, and you're right - the
net-pfs came from the ptrace exploit that I finally found.  Thanks to my
backup history, I was able to find each and every file that changed, and
nailed them all.  Thankfully, all they did was use my box as a proxy to hack
other boxes, and they didn't do any more damage (so far).

I have the ptrace exploit code they used tarred up - email me directly if you
want a copy.  It had a directory in there for 2.6 kernels also.

> Either way, I'm astounded you still have this box running.  You're
> pretty much due a re-install here.  You can't trust this box anymore.

I hear you, but we're talking DAYS of work to get everything back up and
running.  There is a lot of custom stuff I have running.  As I said before, I
think I got lucky, and caught it before it was really damaged.

> Well, I don't know what the bug is, but have you filed a bugzilla
> report?  And, failing that, is there anything stopping you from just
> upgrading apache?  Or, if you know what the fix is, to fix it yourself?
> 
> Either way, you have some work ahead of you.  You can either attempt 
> to fix (or help fix or facilitate the fix) of this apache issue, or 
> you can roll your own kernel and pray that nothing breaks (which it 
> will because nothing else on that system is being upgraded and 
> issues are being found almost daily that affect old stuff like that).
> 
> Frankly, the easier fix (to me) is to try to get that apache issue dealt
> with.  Fiddling with the kernel is a whole lot harder.

Re: CS3.0: I did file the bug on bugzilla, but there's no movement so far.  I
don't know the fix, either.  

Apache and all its related stuff (php, perl, etc...) all seems to be quite
inter-twined that it scares me to think about trying to mess with it outside
of the normal Mandrake config.  And I would think that trying to use 10.1 or
10.2's apache would run me into dependency hell.  Unless you think it will work.

Bob

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________