Incidents
Suspicious files in /tmp Jun 16 2007 06:13PM
kladizkov.thehome (kladizkov thehome gmail com) (3 replies)
Re: Suspicious files in /tmp Jun 18 2007 05:12PM
Jamie Riden (jamie riden gmail com)
Re: Suspicious files in /tmp Jun 18 2007 05:08PM
Jamie Riden (jamie riden gmail com)
Re: Suspicious files in /tmp Jun 18 2007 04:47PM
Matt D. Harris (mdh solitox net) (5 replies)
They're being executed despite filesystem mount options because the
script isn't being executed, the perl interpretter is. The script is
being read and interpretted by the perl interpretter. Interesting - I
hadn't thought of this before. Some logic to check the underlying
filesystem of a script before reading it would be a very cool addition
to perl from a security standpoint. Wouldn't be a big performance hit
at all just to check once every require, etc as well. It'd need to be
somewhat platform specific. Anyways, it would be neat for someone to
bring this up within the Perl community as a possible idea, and maybe
consider python, ruby, and others as well. Then there're various
shells... I tested bash and FreeBSD's /bin/sh, and neither of them
respect the noexec mount flag on FreeBSD either. It seems like this
should be a relatively easy problem to correct, at least for the most
common platforms. It's a thought that I'm going to bring up with the
FreeBSD guys and see what their reaction is. Thanks for bringing this
up here. Take care, Matt

kladizkov.thehome wrote:
> Hi,
>
> My firewall LFD, pulled out three perl scripts from /tmp. It was found
> to be executing in my server. I have attached the scripts along with
> this mail. Is this issue familiar to anyone?
>
> How can a script uploaded to /tmp be executed when it has noexec privilege?
>
>
> ------------------------------------------------------------------------

>
> ------------------------------------------------------------------------
-
> This list sponsored by: SPI Dynamics
>
> ALERT: .How a Hacker Launches a SQL Injection Attack!.- White Paper
> It's as simple as placing additional SQL commands into a Web Form input box
> giving hackers complete access to all your backend systems! Firewalls and IDS
> will not stop such attacks because SQL Injections are NOT seen as intruders.
> Download this *FREE* white paper from SPI Dynamics for a complete guide to protection!
>
> https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70160000000Cn8
E
> ------------------------------------------------------------------------
--

------------------------------------------------------------------------
-
This list sponsored by: SPI Dynamics

ALERT: .How a Hacker Launches a SQL Injection Attack!.- White Paper
It's as simple as placing additional SQL commands into a Web Form input box
giving hackers complete access to all your backend systems! Firewalls and IDS
will not stop such attacks because SQL Injections are NOT seen as intruders.
Download this *FREE* white paper from SPI Dynamics for a complete guide to protection!

https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70160000000Cn8
E
------------------------------------------------------------------------
--

[ reply ]
Re: Suspicious files in /tmp Jun 21 2007 11:38AM
Remko Lodder (remko elvandar org) (1 replies)
Re: Suspicious files in /tmp Jun 21 2007 08:05PM
Cy Schubert (Cy Schubert komquats com)
Re: Suspicious files in /tmp Jun 19 2007 01:33AM
Robin Sheat (robin kallisti net nz) (1 replies)
Re: Suspicious files in /tmp Jun 20 2007 04:47PM
Valdis Kletnieks vt edu (1 replies)
RE: Suspicious files in /tmp Jun 20 2007 11:06PM
Thyago Braga da Silva (tbraga gasecurity com br) (1 replies)
RE: Suspicious files in /tmp Jun 21 2007 05:09PM
kaneda bohater net (1 replies)
Re: Suspicious files in /tmp Jun 22 2007 12:19AM
Eduardo Tongson (propolice gmail com)
Re: Suspicious files in /tmp Jun 19 2007 12:23AM
Rainer Duffner (rainer ultra-secure de)
Re: Suspicious files in /tmp Jun 19 2007 12:17AM
Rainer Duffner (rainer ultra-secure de)
Re: Suspicious files in /tmp Jun 18 2007 09:32PM
Michal Zalewski (lcamtuf dione ids pl) (1 replies)
Re: Suspicious files in /tmp Jun 19 2007 12:37AM
Matt D. Harris (mdh solitox net)


 

Privacy Statement
Copyright 2010, SecurityFocus