[clue-tech] php

[Mike Staver]

I wasn't running phpbb myself, and I hadn't realized that somebody who 
has a personal site on my server was :(  I had given this person an 
account last year an they had a nice little personal page up, nothing 
major.  Turns out, they did have phpBB running... I thought it was Horde 
since that's what I had running, but nope, it was good ol phpbb.

Jed S. Baer wrote:
> On Mon, 20 Dec 2004 12:57:08 -0700
> Mike Staver wrote:
> 
> 
>>I can't find any info on this worm, so I shut down apache on my server 
>>until I can find an updated php rpm.  I ran the latest chkrootkit, but 
>>it didn't find anything - but then again, this worm appears to be very 
>>new since Google doesn't contain any search results for it yet.
> 
> 
> The report I saw (Slashdot? or The Register?) said it was attacking only
> phpBB sites. Are you running phpBB?
> 
> Also reported it doesn't do anything but deface the sites.
> 
> jed

-- 

                                 -Mike Staver
                                  staver at fimble.com
                                  mstaver at globaltaxnetwork.com