Re: [Security-Discuss] Exploits

* Bob Puff <bob-6dd4Sf22++lWk0Htik3J/[email protected]> [2006-04-04 02:22:43 -0400]:

> I did manage to find the point of entrance; and you were right - it wasn't
> mod_ssl.  It was someone's WebCalendar, which is quite a hole it seems unless
> you're running the latest and greatest.

That's a problem with a lot of PHP-related software, or any web
software.  There's so much out there and so many people just don't think
of security when they're coding this stuff.

Glad you found the real point of entrance tho... that means you can
correct it.

> Yes, I did get the mod_ssl problem from that advisory, and you're right - the
> net-pfs came from the ptrace exploit that I finally found.  Thanks to my
> backup history, I was able to find each and every file that changed, and
> nailed them all.  Thankfully, all they did was use my box as a proxy to hack
> other boxes, and they didn't do any more damage (so far).

That's good to hear.

> I have the ptrace exploit code they used tarred up - email me directly if you
> want a copy.  It had a directory in there for 2.6 kernels also.

Please send a copy to me.  If nothing else, I'd like to make sure it
won't work on any other Mandriva versions.

> > Either way, I'm astounded you still have this box running.  You're
> > pretty much due a re-install here.  You can't trust this box anymore.
> 
> I hear you, but we're talking DAYS of work to get everything back up and
> running.  There is a lot of custom stuff I have running.  As I said before, I
> think I got lucky, and caught it before it was really damaged.

Yes, but the pay off is worth it if you know for fact that everything is
pristine and clean.  I've invested days before to fix things like this
(not on my own machines), and it's worth that investment to have the
peace of mind knowing you didn't miss anything.

> > Well, I don't know what the bug is, but have you filed a bugzilla
> > report?  And, failing that, is there anything stopping you from just
> > upgrading apache?  Or, if you know what the fix is, to fix it yourself?
> > 
> > Either way, you have some work ahead of you.  You can either attempt 
> > to fix (or help fix or facilitate the fix) of this apache issue, or 
> > you can roll your own kernel and pray that nothing breaks (which it 
> > will because nothing else on that system is being upgraded and 
> > issues are being found almost daily that affect old stuff like that).
> > 
> > Frankly, the easier fix (to me) is to try to get that apache issue dealt
> > with.  Fiddling with the kernel is a whole lot harder.
> 
> Re: CS3.0: I did file the bug on bugzilla, but there's no movement so far.  I
> don't know the fix, either.  

Keep pushing... =)  Unless the maintainer has closed it, keep posting to
the report asking when/if they're going to fix it.  The least you're
entitled to is an answer.

> Apache and all its related stuff (php, perl, etc...) all seems to be quite
> inter-twined that it scares me to think about trying to mess with it outside
> of the normal Mandrake config.  And I would think that trying to use 10.1 or
> 10.2's apache would run me into dependency hell.  Unless you think it will work.

Yeah, that probably would, unless you rebuilt from source.  Having
worked on Annvix and losely tracking cooker/release versions, you're
right... you can end up doing a lot more than you expect.

For apache, however, it should be fairly simplistic.  All you really
need to do is recompile apache (from the src.rpm) and then rebuild
anything you already have against that version of apache.  About the
only thing I can see possibly being an issue is updating apr-util and
apr; newer apache requires new versions of apr.  But stuff like php,
etc. you should be able to build against that version of apache without
a problem.

I wouldn't grab the 10.x rpms and install them... I'd grab the src.rpm
files and recompile.  9.2 is pretty old so you might run into glibc
problems and other dependencies if you try to install the binary rpms.

-- 
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}
Wasting time like it was free...

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFEMq0iLrxeMv7jCtQRAu5IAKCuWJy4MwSSn+DQZCU7KeUWdQrK8wCfaC/x
LHJ2pHMdPQgsKUiUdaS+6Sk=
=ZjG1
-----END PGP SIGNATURE-----