From owner-freebsd-security  Fri Jun 28  9:35:58 2002
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id CF9CF37B400
	for <freebsd-security@freebsd.org>; Fri, 28 Jun 2002 09:35:48 -0700 (PDT)
Received: from ms.voxeo.com (ms.voxeo.com [64.3.139.11])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 8EA5643E06
	for <freebsd-security@freebsd.org>; Fri, 28 Jun 2002 09:35:48 -0700 (PDT)
	(envelope-from rj@voxeo.com)
Received: from [64.220.201.59] (host59.voxeo.com [64.220.201.59])
 by ms.voxeo.com (iPlanet Messaging Server 5.1 (built May  7 2001))
 with ESMTPA id <0GYF006KSCUWQP@ms.voxeo.com> for freebsd-security@freebsd.org;
 Fri, 28 Jun 2002 09:37:44 -0700 (PDT)
Date: Fri, 28 Jun 2002 09:35:45 -0700
From: RJ Auburn <rj@voxeo.com>
Subject: Re: Apache worm in the wild
In-reply-to: <20020628125817.O68824-100000@axis.tdd.lt>
To: Domas Mituzas <domas.mituzas@microlink.lt>,
	freebsd-security@freebsd.org
Cc: bugtrack <bugtraq@securityfocus.com>, os_bsd@konferencijos.lt
Message-id: <B941DE71.1DCA3%rj@voxeo.com>
MIME-version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
User-Agent: Microsoft-Entourage/10.1.0.2006
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

Is this only effecting freebsd right now?

    RJ

-- 
RJ Auburn
Chief Architect
Voxeo Corporation


On 06/28/02 04:01, "Domas Mituzas" <domas.mituzas@microlink.lt> wrote:

> Hi,
> 
> our honeypot systems trapped new apache worm(+trojan) in the wild. It
> traverses through the net, and installs itself on all vulnerable apaches
> it finds. No source code available yet, but I put the binaries into public
> place, and more investigation is to be done.
> 
> http://dammit.lt/apache-worm/
> 
> Regards,
> Domas Mituzas
> 
> Central systems @ MicroLink Data
> 
> 


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message