Worm Lupper "evolui" e volta a ser ameaça a servidores
Desde o final da semana passada, novas variantes do worm para Linux chamado Lupper estão se deslocando pela Internet. Especialistas no combate aos vírus estão usando uma série de nomes para elas: Plupii.C, Lupper.worm.b, Lupper-I e Mare.d. As novas variantes diferem principalmente nos nomes dos programas maliciosos que carregam e no tipo de Trojan que instalam. Veja o texto completo em heise online - Linux worm Lupper mutates.
As novas versões do Lupper exploram as mesmas falhas (para as quais há correção disponível há 6 meses) da implementação de XMLRPC em PHP usada com mais freqüência em programas de gerenciamento de conteúdo, mas desta vez têm foco especialmente em versões não atualizadas do CMS Mambo.
(postado por Augusto Campos)
Comentários dos leitores
Comentário de Marco Carvalho
22/02/06 22:00 - usuário registrado #186
Se o seu Mambo for anterior: Se o seu Mambo for anterior á versão 4.5.3 e não estiver com o patch que conserta o bug... sim.
--------------------------------------------------------------
Marco Carvalho
http://arrakis.no-ip.info
Maceio - Alagoas - Brazil
Debian GNU/Linux - GNU-PG ID:08D82127
Linux Registered User #141545
--------------------------------------------------------------
Marco Carvalho
http://arrakis.no-ip.info
Maceio - Alagoas - Brazil
Debian GNU/Linux - GNU-PG ID:08D82127
Linux Registered User #141545
Comentário de Manoel Pinho
23/02/06 7:09 - usuário registrado #8
Mambo: Recebi isso na lista de segurança do Mambo:
Dear Subscribers,
There has been a spate of publicity about the Mare.D Linux worm and Mambo in the press recently. We have authored this note to provide some insight into this issue.
The vulnerability described is a known issue which has been addressed by the two previous editions of Mambo. The only thing that is new in this exploit is the Mare.D worm. The link with Mambo is that the worm is seeking copies of Mambo that are not secured against an existing exploit, and using the exploit to install itself.
The vulnerability is the one that was fully described on 21 November 2005, when a patch was provided against such exploits. The patch can be applied to any version of Mambo, or any PHP program. Versions 4.5.3 and 4.5.3h of Mambo already contain the code that protects against this exploit. Provided you are running one of these versions, or have applied the recommended patch to your version of Mambo, you are not vulnerable to the recently reported activities of Mare.D.
Best regards,
Martin Brampton
Leader - Core Development Team
Mambo Foundation
source.mambo-foundation.org
------------------------------
Em breve:
Comunidade de Usuários do Mandriva Linux no Brasil
http://mandrivabrasil.org
Dear Subscribers,
There has been a spate of publicity about the Mare.D Linux worm and Mambo in the press recently. We have authored this note to provide some insight into this issue.
The vulnerability described is a known issue which has been addressed by the two previous editions of Mambo. The only thing that is new in this exploit is the Mare.D worm. The link with Mambo is that the worm is seeking copies of Mambo that are not secured against an existing exploit, and using the exploit to install itself.
The vulnerability is the one that was fully described on 21 November 2005, when a patch was provided against such exploits. The patch can be applied to any version of Mambo, or any PHP program. Versions 4.5.3 and 4.5.3h of Mambo already contain the code that protects against this exploit. Provided you are running one of these versions, or have applied the recommended patch to your version of Mambo, you are not vulnerable to the recently reported activities of Mare.D.
Best regards,
Martin Brampton
Leader - Core Development Team
Mambo Foundation
source.mambo-foundation.org
------------------------------
Em breve:
Comunidade de Usuários do Mandriva Linux no Brasil
http://mandrivabrasil.org
atualizadas do CMS Mambo.
A aplicação CMS pode potencializar o risco e comprometer o sistema
mesmo com o servidor web e o interpretador php atualizados?
---
MARCELO ANDRADE
Linux User #221105
Belem-Para-Amazonia-Brazil