Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Apache Software

Apache Worm in the Wild 85

Posted by michael from the patchy-server dept.
codewolf writes "It has been reported to bugtraq by Domas Mituzas that a worm that exploits the Apache chunk bug has been found in the wild. Information on the worm can be found here. More information on the Apache bug can be found here, and patches can either be made by modifying your config file or upgrading your Apache version."
This discussion has been archived. No new comments can be posted.

Apache Worm in the Wild More

Apache Worm in the Wild

Comments Filter:
  • I use it on all my webserver at home. But for work I'm forced to use IIS and stories like this are the reason why. Slashdot, you aren't doing Apache any favors by publishing this kind of thing--it only makes Open Source software look bad. Please, keep it under your hat.

    • Re:I love Apache (Score:2, Informative)

      by GeekWithGuns ( 466361 )

      Keeping things like this under you hat is exactly how worms get out of control. This hole was fixed 2 weeks ago, if you have not fixed your site by now this is your final warning. If you know any other Apache admins, you should be a nice guy and send them an email to make sure that their site is fixed.

      When Micro$oft kept it quiet about those IIS vulnerabilities, many IIS installs went unpatched. (Ok, if you were a good admin you knew about them, but most sites do not have good admins) This by itself was not a problem, but then Nimda and Code Red hit. Tons of systems ripe for the picking!

      Any system will have bugs (some more than others, but that is not the point here) and a certain percentage of those bugs will be security vulnerabilities. No matter how hard you try to debug the system, there will be some securty hole left to be discovered. The best action is to make sure that everybody who has that system running knows about the hole before it become a problem.

    • Very funny. 12000 IIS bugs last week, I STILL get code red probes every day. Off the top of your head, when was the last apache bug like this? BTW, things like this DO encourage people to upgrade. I had some suspicious signal 11s a couple months ago, and I bet that black hats have been playing around with these exploits for a while. Now fix your boxes, if you haven't already. Fixes have been available for a week already.
    • Put it under your hat? That is exactly how worms get spread so bad! People don't release the information regarding fixes and admins don't do them. With /. posting the information, then more exposure is made regarding the fix. Geez, let's get a clue here! I admin both IIS and Apache sites, and this is actually the first notice I have seen regarding the fix. To bad MS isn't more forth coming with info regarding their problems!

    • Re:I love Apache (Score:1, Insightful)

      by Anonymous Coward
      This looked like a flame on another site, until I read the "keep it under your hat" post here at /.!

      http://www.worldtechtribune.com/worldtechtribune/a sparticles/buzz/bz07022002.asp [worldtechtribune.com]

      "Finley Peter Dunne, a Chicago journalist in the early 20th Century, noted that a journalist was to comfort the afflicted and afflict the comfortable. To most journalists, Microsoft, with billions of dollars in the bank and millions of customers, is viewed as comfortable. Open source software, a development dogma steeped in European socialism with few success stories to its credit, is viewed as afflicted. This kind of pragmatism is nothing new to journalists: In the eyes of most elite tech media journalists, it's more 'fair' to afflict the comfortable Microsoft than it is to beat up on the poor, afflicted Apache developers."

      I hate the lack of freedom imposed on the world by Mico$loth, but the worst thing would be if Apache turned into some kind of lying, closed, corporate slug! How can we in the Open Source community say we love free speech if we are going to hide or cover up issues? We must remain open at all costs to show the closed sourcers we won't stoop to their level.

  • Slashdot (Score:2, Funny)

    by Anonymous Coward
    Is Slashdot fixed?

    Can I be infected by posting this?
  • GOBBLES submitted a proof of concept apache exploit for BSD variants on the BugTraq mailing list. Based on this string found in the chunk overflow request: BLE*h*GOB I would argue that this code was very sloppy indeed. Probably stolen mostly from Gobbles with a worm wrapper thrown around it.
  • It is becoming increasingly discouraging when the 'security consultants' are releasing more exploits than any group of crackers ever could. It seems that BugTraq and NTBugTraq are full of more and more exploit traffic by these companies that are supposed to be protecting us from the threats. It looks to me like these companies are actively engaging in the process of breaking software, pointing to the offending buffer, then proclaiming "See! We help you by protecting you from someone who might have discovered this! By the way, here is the code for 'proof of concept' that any moron with gcc can load on his 1337 box for a little Friday night shenanigans!"
    When is the security end-user community going to come together and fight this as a united front? Make the repurcussions for releasing exploit code so financially devastating, that companies will tremble in fear of releasing -anything- without following proper disclosure [vulnwatch.org].
    Perhaps litigation and financial awards would be a good start. I know eEye should owe me some money for their wonderful disclosure prinicipals last summer.. It was a long weekend rebuilding all our ftp servers.
    • They find problems, the virus scanner companies find problems, etc. to justify their existence. But I think you may have missed some of the introduction in the link you used. How many companies will acknowledge a vulnerability (theoretical) without there being an actual threat in the wild?

      Now, I must admit that MS and others are getting better, but it is still not certain that they will pay attention to various bug reports.

      I also think that a broader view is required. One must also look at the original publisher/programmer, and determine their liability. Is it NTBugTraq's fault for discussing the exploit, or is it Microsoft's fault for ignoring it and/or having the bug in the first place?

      I agree with what you are saying, but am not sure that it goes far enough.
      • You're right about the treatment given theoretical vs. actual threats by most companies. I don't know what the cure for that is going to be. Complancency with regard to systems updating and patching, as we have discovered (read: Code Red), affects us all. In the case of Code Red or Nimda, which used an arsenal of attacks that had patches already released, the liability landed squarely on the admins shoulders.
        I think that BugTraq and it's ilk are valuable tools for the discussion and dissemination of information, and I admittedly would be lost without them.

        I have no problems with liability being ascribed to the software-house when an exploit is disclosed, and nothing is done to fix it. Financial awards are the only thing that is going to wake the industry up from it's casual disregard.

        What I do think turns the tables is when the security company releases proof-of-concept code into the mailing lists of the world. BugTraq is a lifesaver. I wouldn't be adequately informed without it. However, I don't think for a second that easily half the subscribers to the list are script kiddies looking for some nice code to drop in their lap. In this case, I think the liability points directly to the security company for failure to use common sense and good disclosure practices.

        Can you imagine what would happen if everyone who was affected by a worm generated from proof-of-concept code filed a class action against the company that released the code? If each plaintiff only sued for man hours lost, the damages would be astronomical. This weapon could be wielded at Microsoft or any other company as well that failed to patch an exploit that was reported diligently using best-practices, and later used as a worm.

        Usually the only way to make companies listen is to hit them where they'll notice.
    • You hit on some very good points. The entire "security" industry smacks of being ambulance chasers to me. It seems all about self-promotion and little about a genuine concern about ensuring the safety of the world's computing infrastructure.

      Each vulnerability has to be announced with great fanfare, wrapped up in copyright statements, insistance of proper credit being given, and of course the oh so popular naming of the incident like "weave-apache-043 vulnerability notice."

      Here's a few examples from recent bugtraq:

      • Cluestick Advisory #001
      • Westpoint Security Advisory, wp-02-0002
      • Foundstone Advisory, FS-062502-22-AXSH
      • nCipher Advisory #4
      • SNS Advisory No.54

      Now, before you can get that great reputation as a security know-it-all, you have to get your advisory out there. Notifying the vendor quietly so they can do the right thing doesn't serve your immediate needs, and that's publicity. And heaven help the vendor if you do notify them and they don't give you proper credit, else next time you'll just bypass them. Smacks of blackmail, eh?

      The entire security industry just seems chaotic and unprofessional. A lot is riding on doing this right. Hiding this behind a super sekret cabal of "trusted" groups with a high cost of entry to the group isn't the answer, but I don't believe rushing to publish working proof of concept exploits is the answer either.

      If the medical community operated like this, then the first person who identified a horrible disease would notify the drug companies and give them 30 days to come up with a cure, then after 30 days, go public, give out samples to anyone who asks with a disclaimer like "This is for educational purposes only, do not release it into the wild, we are not responsible" and then get the press to hype the fact that everyone is in great danger because some bad person could be releasing this at any moment.

    • When is the security end-user community going to come together and fight this as a united front? Make the repurcussions for releasing exploit code so financially devastating, that companies will tremble in fear of releasing -anything- without following proper disclosure [vulnwatch.org].

      Perhaps litigation and financial awards would be a good start.


      Well, in the US of A they're working on accepting 0 (as in zero) responsibility
      for flaws in their products as a matter of law. Check these resources online
      for info about the UCITA.

      Computer Professionals for Social Responsibility [cpsr.org]

      InfoWorld [infoworld.com]

      Americans for Fair Electronic Transactions [4cite.org]

      One interesting provision, as described on the CPSR page and related to your ideas which I quoted, is:


      UCITA allows software publishers to sell their products "as is" and to disclaim liability for product shortcomings.


      One other interesting aspect of this abomination is the right of the vendor to
      change the terms of the license, at any time, before or after
      the original transaction.

      This battle is fought state by state, in the state legislatures. Somebody in your
      state capital needs to know if you don't like what UCITA means for you.
  • that would explain all the firewall hits from 64.28.67.150.
    • that would explain all the firewall hits from 64.28.67.150.

      Offtopic == they dont get it

      In this particular case, I think your signature is going to be right on target...

      For those that don't get it, that's the public IP for /.
      • Yum...

        [snip -- no, you're not getting your hands on my IP, you little devils, you.]

        bbr01-p0-0.ekgv01.exodus.net (209.1.169.1) 63.594 ms 63.786 ms 64.192 ms
        bbr02-p3-0.okbr01.exodus.net (206.79.9.9) 68.463 ms 63.592 ms 63.789 ms
        bbr02-p4-0.wlhm01.exodus.net (209.1.169.45) 88.655 ms 89.120 ms 88.507 m
        dcr03-g2-0.wlhm01.exodus.net (64.14.70.65) 88.775 ms 89.418 ms 89.015 ms
        csr03-ve241.wlhm02.exodus.net (64.14.70.138) 92.827 ms 91.359 ms 89.139
        64.28.66.204 (64.28.66.204) 89.260 ms 89.179 ms 88.957 ms
        slashdot.org (64.28.67.150) [open] 137.414 ms * *

        Overkill for simple reverse DNS, I know, but way cooler.

        BTW, can anyone identify wlhm, btw? okbr seems to be Oak Brook, IL., but then it's mysteryland.

  • Things to Try (Score:3, Informative)

    by kingosric ( 472809 ) on Friday June 28, 2002 @01:44PM (#3788114)
    The worm saves itself as /tmp/.a, so if root creates an empty file with a-rwx (0000) permissions the worm will not be able to install itself (assuming that your apache isn't running as root, yeh?)
    Of cource, the sensible, long term solition is to upgrade to 1.3.26, but as a short term fix this may work (I've not tried it btw - I just upgraded :-)
    • Even if you are running as root (the parent does run as root even though the child processes are nobody:nobody) you could just set up a cron to check for that file every few minutes:

      #!/bin/sh
      WORM='/tmp/.a'
      if [ -f "$WORM" ] ; then
      echo 'APACHE WORM DETECTED'
      rm "$WORM" ||
      echo "ERROR: Was unable to delete $WORM"
      fi
      If this runs as a cron, the output will be mailed to you.
    • rm depends on permissions of the containing directory, not the file. Since the worm does rm -f before the cat, make sure you have your /tmp permissions right.

      If you set the sticky bit on the directory (most tmps have it set already) the file can't be removed unless the owner of the rm process and the owner of the file match. Then the cat should fail.

      Also try chflgs if you're running on freebsd (other BSD's probably have equivs).
    • Ahh, but most people seems to not know about the ext2/3 file attributes.
      Something like:
      touch /tmp/.a
      chmod 000 /tmp/.a
      chattr +i /tmp/.a

      would make that file immutable. Not even root can touch it until root does chattr -i.

      And now you know why I run ext3 :)

  • For those of you that like the horror stories, are some excerpt of # strings .a (of the linux version of course).

    (snip)
    /bin/.log
    (snip)
    GET /%s HTTP/1.0 Connection: Keep-Alive User-Agent: Mozilla/4.75 [en] (X11; U; Linux 2.2.16-3 i686)
    (snip)
    GET /%s HTTP/1.0 Host: %s Accept: text/html, text/plain, text/sgml, */*;q=0.01 Accept-Encoding: gzip, compress Accept-Language: en User-Agent: Lynx/2.8.4rel.1 libwww-FM/2.14
    (snip)
    rm -rf /tmp/.a;cat > /tmp/.uua /tmp/.a;killall -9 .a;chmod +x /tmp/.a;killall -9 .a;/tmp/.a %s;exit; 12.127.17.7 %c%s HELO %s MAIL FROM: RCPT TO: DATA QUIT
    (snip)
    mv /tmp/tmp /tmp/init;export PATH="/tmp";init %s /bin/sh
    (snip)
    Udp flooding target Tcp flooding target Sending packets to target Dns flooding target
    (snip)
    So to summarize, this nasty beast will:
    • r00t your box
    • send e-mail
    • do DOS
    • fake beeing mozilla or lynx
    Hey apache admin abroad: wake up !
    • *If* thats all it does, I tip my hat to the writer of the worm: at least it doesen't destroy any data and you can recover.

      If I meet the worm writer - I'm tempted to throttle him on one hand, and shake his hand on the other. It's kinda like a house burgler who steals all your top-ramen and doesen't take your expensive jewlery. Annoying, but in the long run, there wasen't much damage and you securty system had been debugged.

      Tough call.

    • fake beeing mozilla or lynx

      Aughfully clever way for Mozilla to gain market share ;)

  • And why is this not on the front page? (Score:4, Flamebait)

    by |DaBuzz| ( 33869 ) on Friday June 28, 2002 @03:05PM (#3788607)
    How odd ... a site that caters to those who use open source software are continually bombarded with reports of how IIS is swiss cheese on the front page, yet when critical OPEN SOURCE security issue comes about, it comes out regarding one of the most, if not THE most used open source application in the world, it is a day late and not published on the front page.

    It would appear that the posting security advisories on this site are not to HELP admins, but instead to bash those you don't like.

    • Well, /. has never advertised to be the top-notch advisory source you wants to connect to... They have a lot of claims, but not that one indeed.
      Generally, if you really are a security admin, you look at bugtrak, etc.etc.

      OTOH, sorry for the Mozilla/Netscape mistake: you are damn right.

      And no, this is not all it does: I did forget to mention it infected unpatched apache servers didn't I ? So I probably forgot a lot more ;->

    • Heres [slashdot.org] the /. story of the bug (was on front page, 17 june), and heres [slashdot.org] the story of the release a day later of a update FIXING the bug.

      Obvious this worm only affects ppl who have not updated their apache, and to laugh at ur 'IIS swiss cheese' which seems to take a couple of months before a fix is released (not to mention the foolish concept that you can hide any bug via secuirty through obscurity)

      • The stories you cite are regarding the a DoS with Apache, NOT a worm that is now known to exist. There is a big difference between some packet monkey making apache restart and someone rooting your box and executing arbitrary code.

        And to add insult to injury, there is a front page story about some OS X security items with no mention of this apache worm, just that Apache has been upgraded.

        Now tell me this, are there more Apache admins reading the front page or Apple users?

        Having this story here and NOT on the front page is laughable and does not frame the "open source community", one of which slashdot is a corner stone, in a positive light. It shows that they are just as willing to obscure security problems and flaws in their preferred products as those who they despise for using MS products.
    • It would appear that the posting security advisories on this site are not to HELP admins, but instead to bash those you don't like.

      I feel this is not a security advisory site and it also is not the "admin help" site. As far as I know it's news for nerds.

      They did have it on the frontpage some days ago when the bug was news. The only ones who could be complainting now would be some of the lazy admins who don't care enough to fix it before the worms appear.

      I suppose it is not in the frontpage because this is not exactly interesting news to most of the people.
      • I suppose it is not in the frontpage because this is not exactly interesting news to most of the people.

        Are you out of your fucking mind?? NOT interesting news? Please. This is like posting a report about a buffer overflow in the hta parser in IIS on the front page, but never posting a story about Code Red and variants.

        This is a really lame attempt at a cover-up, plain and simple. This site it the first to bash IIS, but when the real hole hits, the one that affects the product they all tout as being the best, the one that is appearently used by most of the web servers on the Internet, well, we like to hide that one around here.

        Slashdot is finally showing its true colors. This site is about as unbiased as Salon.com.
    • If you can't take the anti-M$ slant, stay out of the Slashdot. It has long ago ceased to be either interesting or insightful to remark that the posters and editors of Slashdot apply a double standard when publicising security flaws, etc. Everyone knows this.
      As a note to moderators: this is not insightful. The first time someone has an idea, that is insightful. The millionth time is redundant.

  • Is this x86 only? (Score:3, Interesting)

    by stego ( 146071 ) on Friday June 28, 2002 @03:50PM (#3788856) Homepage
    Does this worm run on all platforms, or just x86?

    • Re:Is this x86 only? (Score:4, Informative)

      by You'reAFuckingMoron ( 587707 ) on Friday June 28, 2002 @04:34PM (#3789135)
      I'm not an expert on this type of thing, but it looks like the worm caught in the honey-pot is BSD/x86 only.

      It appears to be based on the GOBBLE exploit which was released a few days ago, which was BSD only in the form posted on BugTraq. However, GOBBLES claim their exploit can be modified to work on OpenBSD, FreeBSD, Linux 2.4, and Solaris.

      There have also been claims that Win32 Apache is vulnerable, although I haven't seen an exploit on BugTraq. If GOBBLES is correct, then it's only going to be a matter of time before this worm is polished up and set out into the wild in a form that can hit just about everyone. Hell, with some work, maybe a good hacker could clean it up, add it with the Nimda code and hit just about everything under the sun.

      • The Apache worm looks like FreeBSD only, BUT any good sys admin is going to assume that worms are out there now (or will be shortly) that will root and destroy their systems. Paranoid, yes, but..

        In this case, the Apache upgrade was so painless (and I even had the slight complication of mod_ssl) that there's no excuse not to upgrade.

  • For those of you that do not need a web server, turn it off.

  • Source code link (Score:2, Informative)

    by codewolf ( 239827 )
    Source code for the worm [dammit.lt]
  • Why is this not on the main page?? With all the Apache servers out there, this is a HUGE deal!

    • Re:isn't this big news? (Score:3, Insightful)

      by edhall ( 10025 )

      (Time to blow some karma.)

      Because it isn't IIS.

      I don't use Microsoft products. I use Apache, at work and at home, on Linux and FreeBSD. But I also recognize hypocrisy when I see it. This is the Code Red of the Apache world. So far as "News for Nerds. Stuff that matters" it's more significant than 95% of what appears on the front page.

      CT and the Slashdot crew should hang their heads in shame.

      -Ed

  • Very cheap workaround (Score:1, Informative)

    by DeHackEd ( 159723 )
    $ su -
    # cd /tmp
    # touch .a .uua
    # chattr +i .a .uua
    # exit

    This should hold the worm off until I get the chance to do a proper upgrade. I've got too much of a headache to recompile Apache and try to get all the modules I want working right now.

    Standard disclaimer: this workaround should not be used by anyone who actually wants protection against this exploit.

  • maybe modify the worm to notify www@domain that the server is exploitable?
  • According to the reference page [dammit.lt], the actual exploit is done by sending an HTTP POST request to a vulnerable server. Is it enough to put a restrictive LIMIT POST directive in the .htaccess or httpd.conf file? Or would the server still be vulnerable?

    FYI, running on cable in the ever-popular 24 /8 and haven't seen anything strange in the access log (yet)

Slashdot Top Deals

To the landlord belongs the doorknobs.

Close