FreeBSD-SA-04:13.linux in the wild

Has anyone else seen this in the wild?

We just had an attempted attack yesterday from a live attacker on one of
our machines using this vulnerability. It wasn't all that clever, and
they're long gone, but I *did* manage to catch them in the act and grab
a copy of the binary they tried to run from /tmp/, as well as the PHP
injection code they used to subvert a virtual web site's poorly-written
index.php script to execute commands as a local user.

Their first order of business was uname -a, and the timing of the
requests appeared to be random and experimental ("cd /tmp; ls -la", a
few times). If any @FreeBSD.org developers would like more information,
I'd be happy to share my findings and log output off-list.

- Ryan

-- 
   Ryan Thompson <[e-mail]>

   SaskNow Technologies - http://www.sasknow.com
   901-1st Avenue North - Saskatoon, SK - S7K 1Y4

         Tel: [phone]   Fax: [phone]   Saskatoon
   Toll-Free: 877-727-5669     (877-SASKNOW)     North America
_______________________________________________
[e-mail] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "[e-mail]"