Massala PHP exploit via worm

Article View: be.comp.security

Article #628

#628

From: Cyrano
Date: Thu, 23 Dec 2004 05:20

8 lines
1310 bytes

Voor alle mensen die een site met PHP runnen: check your updates.

Er circuleert al een worm die via Google sites opspoort die met behulp
van PHP gemaakte BBS-software draaien. Ca. 40.000 sites werden in
enkele uren defaced.

Google blokkeert al de requests en de meeste sites waren zeer snel
terug hersteld. Er waren ook Belgische sites tussen.

Technical Details

Message-ID: <1103779258.014624.13110@z14g2000cwz.googlegroups.com>

Path: arc1-ca.pugleaf.net!g2news1.google.com!postnews.google.com!z14g2000cwz.googlegroups.com!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Thread: 113446,1485981469779295,start
X-Google-Attributes: gid113446,public
X-Google-Language: DUTCH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!postnews.google.com!z14g2000cwz.googlegroups.com!not-for-mail
From: "Cyrano" <cyrano.mac@techemail.com>
Newsgroups: be.comp.security
Subject: Massala PHP  exploit via worm
Date: 22 Dec 2004 21:20:58 -0800
Organization: http://groups.google.com
Lines: 9
Message-ID: <1103779258.014624.13110@z14g2000cwz.googlegroups.com>
NNTP-Posting-Host: 213.119.136.143
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
X-Trace: posting.google.com 1103779261 13082 127.0.0.1 (23 Dec 2004 05:21:01 GMT)
X-Complaints-To: groups-abuse@google.com
NNTP-Posting-Date: Thu, 23 Dec 2004 05:21:01 +0000 (UTC)
User-Agent: G2/0.2
Complaints-To: groups-abuse@google.com
Injection-Info: z14g2000cwz.googlegroups.com; posting-host=213.119.136.143;
   posting-account=n1A5jg0AAACnGyRQyRcBZT1baa1eX_RI