New worm segfaults apache

From: bugtraq (bugtraqat_private)
Date: Tue Sep 18 2001 - 08:37:11 PDT

Next message: John Q. Public: "Re: nimda tries to send mail after reboot"

Previous message: Brian Pomeroy: "Re: Concept Virus(CV) V.5 - Quick analysis update"
Next in thread: Chip McClure: "Re: New worm segfaults apache"
Reply: Chip McClure: "Re: New worm segfaults apache"
Reply: Chris Arnold: "RE: New worm segfaults apache"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello,


Over 15 times my apache has segfaulted whenever I get scanned by this worm.

Sep 18 13:30:15 cgisecurity /kernel: pid 35290 (httpd), uid 1003: exited on signal 11
Sep 18 13:38:03 cgisecurity /kernel: pid 35390 (httpd), uid 1003: exited on signal 11
Sep 18 14:06:00 cgisecurity /kernel: pid 35391 (httpd), uid 1003: exited on signal 11
Sep 18 14:20:51 cgisecurity /kernel: pid 35453 (httpd), uid 1003: exited on signal 11
Sep 18 15:27:22 cgisecurity /kernel: pid 35740 (httpd), uid 1003: exited on signal 11
^C

Any idea why apache is segfaulting? I have 250 megs of free ram without proccess limits and
it segfaults. Also I tried every string and have been unable to replicate it manually.

- adminat_private


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: John Q. Public: "Re: nimda tries to send mail after reboot"
Previous message: Brian Pomeroy: "Re: Concept Virus(CV) V.5 - Quick analysis update"
Next in thread: Chip McClure: "Re: New worm segfaults apache"
Reply: Chip McClure: "Re: New worm segfaults apache"
Reply: Chris Arnold: "RE: New worm segfaults apache"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Sep 18 2001 - 14:30:42 PDT