Linux Lupper.Worm In the WIld

jurt1235 writes "McAfee reports that a Linux worm has been found in the wild. The Linux/Lupper.worm is a derivative of the Linux/Slapper worm which also exists for BSD, just to be crossplatform. From the McAfee description: The worm blindly attacks web servers by sending malicious http requests on port 80. If the target server is running one of the vulnerable scripts at specific URLs and is configured to permit external shell commands and remote file download in the PHP/CGI environment, a copy of the worm could be downloaded and executed."

CONTINUE:

[xtracto]

Next, is a collection of messages telling that it is the fault of the system andministrators and not a problem of the Linux Distributions.

p.s. BURN KARMA BURN!

Complete infection

[soren.harward]

All sysadmins who are still running this insecure setup are advised to patch your systems immediately. Yes, all fourteen of you.

Before all teh MSFT fanboys jump on this,

[Anonymous Coward]

Paraphrased from the virus description;

IF you run a specific kernel version with some special module
AND you run one of a couple specific versions of one package not installed by default
AND you have a very "generic" config on that package
AND you have some plugins enabled, but not configured for security
AND you are on a world routable IP address
AND you have some specific vulnerable scripts,

THEN you might need to take a look at if you are at risk.

Paraphrased from the virus description of most MSFT worms:

IF you run an MSFT operating system
AND you havent reformated your HDD in the lsat hour

THEN its time to pucker up and kiss the sucker goodbye..

-GenTimJS

Re:CONTINUE:

[EraserMouseMan]

Of course, Linux is perfect by definition.

And I'm sure this worm was written by a Microsoftie or possibly by Bill Gates himself.

I'm not worried...

[PoprocksCk]

I doubt I'll have the libraries required to run this worm.

Linux/BSD only

[WhiteWolf666]

Currently, this worm is only compatible with Linux/BSD systems, because they are the only systems with full shell scripting capabilities.

It is rumored that you can obtain the same level of compatibility with the Cygwin Suite, but that is not an officially supported configuration by Microsoft.

Never fear, though, Monad will bring Lupper, and similar PHP/Shell script worms to the Windows platform for the masses!

Seriously, though; isn't everyone fairly aware that PHP ain't that secure?

Re:Conditions for infection...

[maxwell demon]

Hey, I've found a way to write a true Linux worm! It can infect all Linux computers which have a user named "wormhole" with password "unsafe", and have a suid-root copy of bash installed at /bin/rootbash which is executable by user "wormhole". Ah, and of course the user "wormhole" must be able to remote login through either rlogin or ssh with password authentication enabled. To spread, the worm also needs the file /etc/wormspreadrc, which must contain a list of other vulnerable computers, one hostname or IP number per line.

SCNR

Re:I'm not worried...

[WinterSolstice]

Ha!

Yes, if your luck with PHP on linux is like mine, you'll have to resolve dependencies for about 15 minutes first :)

-WS

Gnu!

[rabel]

That's Gnu/Linux worm to you, you insensitive clod!

clearly a violation

[FudRucker]

if this worm does not include the sourcecode with every computer it infects it is violating the terms and conditions of the GNU/GPL

Re:if it attacks PHP cross-platform...

[Anonymous Coward]

Oh, and while we're at it, aren't these virii more specifically Linux/i386 and BSD/i386 virii ?

No, there aren't. Primarily because "virii" IS NOT A WORD YOU TWIT!

Re:Remarkably Useless page.

[tomhudson]

I'll tell you what, anyone wants some practice exploiting the hole, here's the IP address of a vulnerable machine to practice on: http://127.0.0.1/ [127.0.0.1]

Knock yourselves out :-)

Re:I'm not worried...

[_Sprocket_]

apt-get install morrisworm2

Re:Remarkably Useless page.

[Macrobat]

You know, if you link to a porn site, you could at least warn us.

They are just now discovering this???

[Christianfreak]

I've been seeing requests for some of these URLs for 6 months now. I figured it was a worm but I know I'm patched and I don't run any of that stuff anyway. Amazing to me that people get owned by this sort of thing.

Between this and the SSH worm, maybe its time to investigate using Windows ME with Personal Web Server. :-D

Re:CONTINUE:

[rtb61]

Only if the worm turns and starts to attack windoze boxen instead, thats the defining nature of redmond code, bugs.