Re: .bugtraq Worm

On Sat, Sep 14, 2002 at 12:36:08PM +0100, Geoff Amabilino wrote:
> FYI, this is an OpenSSL bug, not directly an Apache bug.  Check RH
> security updates..

Yes, 

http://www.sophos.com/virusinfo/analyses/linuxslappera.htm


Linux/Slapper-A is a worm which tries to exploit a buffer overflow
vulnerability in the OpenSSL component of SSL-enabled Apache web
servers. Once active, the worm can be used as a backdoor to start up a
range of denial-of-service attacks.

Linux/Slapper-A spreads between systems via TCP port 443 (SSL). Before
connecting to this port, the worm connects to TCP port 80 (HTTP) in
order to try to customise its attack for specific Apache versions. If
a web server other than Apache (or which identifies itself as other
than Apache) is found, the worm will not attempt to infect.


[...]


If Linux/Slapper-A successfully breaks into its victim, the worm
injects a shell script into the remote shell it has launched. The
shell script contains a uuencoded copy of the worm's own source code.
The script decodes this source code into the file /tmp/.bugtraq.c,
compiles it using gcc into the executable file /tmp/.bugtraq and then
executes it. A daemon process called .bugtraq will be visible on
infected computers.

Note that the Linux/Slapper-A worm depends on the presence of the gcc
compiler on victim computers, and also requires that the compiler be
executable by the Apache user. Sophos recommends removing, or
limiting access to, the compiler on production web servers.

Once active, Linux/Slapper-A opens up a backdoor which can be
contacted via UDP port 2002. The backdoor is intended to allow a range
of attacks to be initiated from infected computers, such as: executing
arbitrary commands; creating TCP floods; creating DNS floods and
searching for email addresses on disk.

-- 
Hal Burgiss