Re: Massala PHP exploit via worm

Article View: be.comp.security

Article #643

#643

From: Christophe Vandeplas
Date: Thu, 30 Dec 2004 12:41

45 lines
2505 bytes

--=-fZ86B+1JEKvEljSfrdKk
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Thu, 2004-12-30 at 12:15 +0000, frank@openminds.be wrote:

> De eerste variant van de worm zou niet door bovenstaande rules gevat
> worden. De instructies werden gemaskeerd opgebouwd door een
> chr(nummertje)... De tweede zou je waarschijnlijk wel gevat hebben, maar
> ik ken ook applicaties die parameters "echo" en zo wel legitiem
> gebruiken ...

Het is inderdaad steeds een compromis zoeken tussen 'veiligheid' en
'gebruiksvriendelijkheid' ...

Dat is nu eigenlijk de uitdaging van de huidige
security-verantwoordelijke van een bedrijf

--=20
-------------------------------------
Christophe 'ElCascador' Vandeplas
GSM: +32 (0)486/64.10.33
email: christophe(at)vandeplas(dot)com
http://www.vandeplas.com
GnuPG:1024D/14913897: 66BD A9EB 0357 D80F 20D4  D698 3B2B E562 1491 3897
-------------------------------------
*** PLEASE ***
"Never send mass-mails/forward to this email address.
 Please add the email-address to the BCC field (Blind Carbon Copy)
 or send the mail separately to me."

--=-fZ86B+1JEKvEljSfrdKk
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBB0/eCOyvlYhSROJcRApm4AJ9H+fMVKPgGvA05SyzrFbMGwqOeLACeLh8i
S+H/ncUlEare9AfWw7QzRh8=
=sky/
-----END PGP SIGNATURE-----

--=-fZ86B+1JEKvEljSfrdKk--

Technical Details

Message-ID: <1104410500.5072.1.camel@localhost>

Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail

References:

<1103779258.014624.13110@z14g2000cwz.googlegroups.com> <32vnb3F3r441iU1@individual.net> <t2Wyd.9133$W74.624760@phobos.telenet-ops.be> <3367orF3svi2hU1@individual.net> <1104397278.4987.6.camel@localhost> <33i9r6F409iq4U2@individual.net>

Show Full Headers

Complete Article Headers

X-Google-Thread: 113446,1485981469779295
X-Google-Attributes: gid113446,public
X-Google-Language: DUTCH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Christophe Vandeplas <christophe@vandeplas.com>
Newsgroups: be.comp.security
Subject: Re: Massala PHP  exploit via worm
Date: Thu, 30 Dec 2004 13:41:39 +0100
Lines: 46
Message-ID: <1104410500.5072.1.camel@localhost>
References: <1103779258.014624.13110@z14g2000cwz.googlegroups.com>
  <32vnb3F3r441iU1@individual.net>
  <t2Wyd.9133$W74.624760@phobos.telenet-ops.be>
   <3367orF3svi2hU1@individual.net> <1104397278.4987.6.camel@localhost>
   <33i9r6F409iq4U2@individual.net>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature";
 boundary="=-fZ86B+1JEKvEljSfrdKk"
X-Trace: individual.net IoP4nFFdPRbrqv7x9xVp/Qbk7ali248otp+lUTVN7NHqNPYVCt
In-Reply-To: <33i9r6F409iq4U2@individual.net>
X-Mailer: Evolution 2.0.2

Reply to Parent Message