[26013] in bugtraq
Re: Apache worm in the wild
daemon@ATHENA.MIT.EDU (Brett Glass)
Sat Jun 29 00:51:33 2002
Message-Id: <4.3.2.7.2.20020628112127.024d9410@localhost>
Date: Fri, 28 Jun 2002 11:27:13 -0600
To: flynn@energyhq.homeip.net, Domas Mituzas <domas.mituzas@microlink.lt>
From: Brett Glass <brett@lariat.org>
Cc: freebsd-security@FreeBSD.ORG, bugtraq@securityfocus.com,
os_bsd@konferencijos.lt
In-Reply-To: <20020628113834.GA10062@energyhq.homeip.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
At 05:38 AM 6/28/2002, flynn@energyhq.homeip.net wrote:
>I wonder how many variants of this kind of thing we'll see, but I assume most people
>running Apache have upgraded already.
Upgrading Apache may prevent your system from being taken over,
but it doesn't necessarily prevent it from being DoSed. One of
my Apache servers, which had been upgraded to 2.0.39, went berserk
on June 25th, spawning the maximum number of child processes and
then locking up. The server did not appear to have been infiltrated,
but the logs were filled with megabytes of messages indicating that
the child processes were repeatedly trying to free chunks of memory
that were already free. Probably the result of an attempted exploit
going awry. (It could have been aimed at Linux, or at a different
version of Apache; can't tell. But clearly it got somewhere, though
not all the way.)
--Brett
