FreeBSD-SA-04:13.linux in the wild
ryan at sasknow.com
Wed Aug 11 14:07:15 PDT 2004
Has anyone else seen this in the wild?
We just had an attempted attack yesterday from a live attacker on one of
our machines using this vulnerability. It wasn't all that clever, and
they're long gone, but I *did* manage to catch them in the act and grab
a copy of the binary they tried to run from /tmp/, as well as the PHP
injection code they used to subvert a virtual web site's poorly-written
index.php script to execute commands as a local user.
Their first order of business was uname -a, and the timing of the
requests appeared to be random and experimental ("cd /tmp; ls -la", a
few times). If any @FreeBSD.org developers would like more information,
I'd be happy to share my findings and log output off-list.
Ryan Thompson <ryan at sasknow.com>
SaskNow Technologies - http://www.sasknow.com
901-1st Avenue North - Saskatoon, SK - S7K 1Y4
Tel: 306-664-3600 Fax: 306-244-7037 Saskatoon
Toll-Free: 877-727-5669 (877-SASKNOW) North America
More information about the freebsd-security