RE: New worm segfaults apache

From: Chris Arnold (chris.arnoldat_private)
Date: Tue Sep 18 2001 - 14:37:24 PDT

  • Next message: robhat_private: "RE: New worm segfaults apache"

    What version of Apache?
    
    Chris
    
    -----Original Message-----
    From: bugtraq
    To: incidentsat_private
    Sent: 9/18/01 11:37 AM
    Subject: New worm segfaults apache
    
    Hello,
    
    
    Over 15 times my apache has segfaulted whenever I get scanned by this
    worm.
    
    Sep 18 13:30:15 cgisecurity /kernel: pid 35290 (httpd), uid 1003: exited
    on signal 11
    Sep 18 13:38:03 cgisecurity /kernel: pid 35390 (httpd), uid 1003: exited
    on signal 11
    Sep 18 14:06:00 cgisecurity /kernel: pid 35391 (httpd), uid 1003: exited
    on signal 11
    Sep 18 14:20:51 cgisecurity /kernel: pid 35453 (httpd), uid 1003: exited
    on signal 11
    Sep 18 15:27:22 cgisecurity /kernel: pid 35740 (httpd), uid 1003: exited
    on signal 11
    ^C
    
    Any idea why apache is segfaulting? I have 250 megs of free ram without
    proccess limits and
    it segfaults. Also I tried every string and have been unable to
    replicate it manually.
    
    - adminat_private
    
    
    ------------------------------------------------------------------------
    ----
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Sep 18 2001 - 18:48:32 PDT