[Xitami] Security Issue - Disabling Script Processing

[carlos]

One more thing.
This security crater, allows a hacker to control your server, and things
like pop up messages or run remotely your explorer can be done

This is one frequently used:

http://ipremote/scripts/root.exe?/c+  (this is codered)

Maybe you find some message already written on your HD.

something like a folder with the name "c:/...your_PC_has_aproblem/
is common.

Carlos

----- Original Message -----
From: "admin" <admin@zonacharrua.com>
To: <xitami@lists.xitami.org>
Sent: Tuesday, January 14, 2003 5:52 PM
Subject: Re: [Xitami] Security Issue - Disabling Script Processing


> >
> > In addition, to the other gentlemen's comment, this has also nothing to
do
> > with a firewall or not.  This hack is coming in on port 80 which the
> > firewall has no control over.  The router routes port 80 traffic to our
> > internal web server correctly.
>
> Sure.
> But once you can be infected by a Nimda kind of virus, the firewall will
ask
> you if you allow the move out to the internet.
>
> I`m not saying this is Nimda, but if a troyan is planted into your server,
> then it will search new victims, and the firewall will tell you that move.
>
> I get hundreds of such attemps everyday, but the answer is always 404.
>
> Get your W2K updates, and tune your antivirus as well.
>
> Good luck:
>
> Carlos
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami