NeverEverNoSanity WebWorm

[ADoxx]

Just a quick question for anyone in the know... many websites are being
defaced for the last day or so with a worm called "NeverEverNoSan ity
WebWorm". We have two sites affected (and down) by it right now and we are
under the assumption it is PHP that is the door for it to get in. Of
course we could be completely way off base, but I thought I'd throw this
out to this news group just in case. If anyone has any info or might know
the cure please please respond.... many thanks!

AMD

[Bigcoupe@gmail.com]

Re: NeverEverNoSani ty WebWorm

I have the same problem.
Do you run phpBB? I suspect this is how they are defacing the sites

[ADoxx]

Re: NeverEverNoSani ty WebWorm

On Tue, 21 Dec 2004 08:33:50 -0800, Bigcoupe wrote:
[color=blue]
> I have the same problem.
> Do you run phpBB? I suspect this is how they are defacing the sites[/color]

Indeed we do. We run phpBB2, but also a commercial CMS package. Both were
affected. Basically it overwrote *every* .php file on the server with it's
own HTML content. What leads you to think its phpBB? Not doubting you,
just curious.. maybe you've found something we havent. According to our
logs, the server itself wasn't breached, only web content (namely PHP
files). Hope this helps. I can give more info to anyone who requests :)

[tcd004]

Re: NeverEverNoSani ty WebWorm

I have the same problem. I also run phpbb.

My host did a full site restore. The site was back up for about 5
minutes, and whammo, the worm executed again.

tcd004

ADoxx wrote:[color=blue]
> On Tue, 21 Dec 2004 08:33:50 -0800, Bigcoupe wrote:
>[color=green]
> > I have the same problem.
> > Do you run phpBB? I suspect this is how they are defacing the[/color][/color]
sites[color=blue]
>
> Indeed we do. We run phpBB2, but also a commercial CMS package. Both[/color]
were[color=blue]
> affected. Basically it overwrote *every* .php file on the server with[/color]
it's[color=blue]
> own HTML content. What leads you to think its phpBB? Not doubting[/color]
you,[color=blue]
> just curious.. maybe you've found something we havent. According to[/color]
our[color=blue]
> logs, the server itself wasn't breached, only web content (namely PHP
> files). Hope this helps. I can give more info to anyone who requests[/color]
:)

[ADoxx]

Re: NeverEverNoSani ty WebWorm

On Tue, 21 Dec 2004 08:51:00 -0800, tcd004 wrote:
[color=blue]
> I have the same problem. I also run phpbb.
>
> My host did a full site restore. The site was back up for about 5
> minutes, and whammo, the worm executed again.
>[/color]

I am thinking we are getting OT here, but this is ok since someone else
might come to this group looking for answers just as I did... but I think
I found a fix. Will post here if it works! :)

[Bigcoupe@gmail.com]

Re: NeverEverNoSani ty WebWorm

Well, there was both a PHP and a phpBB security release last week.
This is what leads me to believe that it was a combo of both. I
upgraded and it happened again. After looking into things a bit more,
I did find these:

home.php
r57.php
r57.php?

All with the same dates and in Apache's doc root. The r57.php script
allowed ANY command to be run on the server!.
I have cleaned up but am watching it closely.

[Avi Norowitz]

Re: NeverEverNoSani ty WebWorm

I encountered two servers this morning with this problem at the
dedicated hosting company I work for. I suspect a worm is exploiting
this vulnerability:

http://www.hardened-php.net/advisories/012004.txt

The PHP website strongly encourages users to upgrade to PHP 4.3.10 or
5.0.3, presumably because of the above vulnerability:

http://www.php.net/

ADoxx wrote:[color=blue]
> Just a quick question for anyone in the know... many websites are[/color]
being[color=blue]
> defaced for the last day or so with a worm called "NeverEverNoSan ity
> WebWorm". We have two sites affected (and down) by it right now and[/color]
we are[color=blue]
> under the assumption it is PHP that is the door for it to get in. Of
> course we could be completely way off base, but I thought I'd throw[/color]
this[color=blue]
> out to this news group just in case. If anyone has any info or might[/color]
know[color=blue]
> the cure please please respond.... many thanks!
>
> AMD[/color]

[ADoxx]

Re: NeverEverNoSani ty WebWorm FIX?

Ok everyone, here it is....

After taking heed of Bigcoupe's suggestion on a possible phpBB
vulnerability, I downloaded version 2.0.11 (we were running 2.0.8) and
patched it. We are also on PHP 4.3.10 as well. This is the highest our CMS
will allow us to go, as well as Zend Optimizer (it won't let us use
hardened-PHP). I've got our boards currently disabled and everything seems
to be ok, but will enable them soon to further test.

On that same note, on the phpBB site, there are a few threads of interest:

http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240513 (the 2.0.11 update
does this for you actually)

http://www.phpadvisory.com/advisories/view.phtml?ID=42

http://www.phpbb.com/phpBB/viewtopic.php?t=248811&highlight=neverevernosanity

http://www.phpbb.com/phpBB/viewtopic.php?t=241300&highlight=neverevernosanity

(this one is a sticky)

http://www.phpbb.com/phpBB/viewtopic.php?t=248539&highlight=neverevernosanity

I will post more as I find out if you like. I know its a bit off topic
here, but hoping it might help someone else with the same issue.

Adam

[Avi Norowitz]

Re: NeverEverNoSani ty WebWorm

After performing some additional research I have found that the problem
seems to be a phpBB vulnerability rather than a PHP vulnerability.

A security vulnerability has recently been discovered in phpBB 2.0.10
and earlier versions. Further, a worm recently began circulating that
exploits vulnerable versions of phpBB. If you are using phpBB, then you
should upgrade to phpBB 2.0.11 to secure this vulnerability.

You can find more information about the recent phpBB security
vulnerability and the worm at the websites below:

http://www.kaspersky.com/news?id=156681162

http://www.securiteam.com/unixfocus/6J00O15BPS.html

http://www.phpbb.com/phpBB/viewtopic.php?t=244451

http://www.phpbb.com/phpBB/viewtopic.php?t=248811

[mazdaf]

Re: NeverEverNoSani ty WebWorm

So the fix is to update phpbb and PHP, or add a fix to viewfiles.php.
This will prevent further attacks by this worm, correct?
Isn't this a worm, does the worm still exist on the server, if so how
can it be found and deleted?

[LarryD]

Re: NeverEverNoSani ty WebWorm

It seems to be a PHP vulnerability as our UBB was also effected. I
changed the permissions to 600 (owner-only rights) and the files were
still altered/replaced.

[Andy Hassall]

Re: NeverEverNoSani ty WebWorm

On Tue, 21 Dec 2004 06:59:17 -0800, ADoxx <adoxx@hotmail. com> wrote:
[color=blue]
>Just a quick question for anyone in the know... many websites are being
>defaced for the last day or so with a worm called "NeverEverNoSan ity
>WebWorm". We have two sites affected (and down) by it right now and we are
>under the assumption it is PHP that is the door for it to get in. Of
>course we could be completely way off base, but I thought I'd throw this
>out to this news group just in case. If anyone has any info or might know
>the cure please please respond.... many thanks![/color]

http://www.theregister.co.uk/2004/12/21/santy_worm/

http://www.kaspersky.com/news?id=156681162

Says it's a phpBB vulnerability, fixed in 2.0.11.

--
Andy Hassall / <andy@andyh.co. uk> / <http://www.andyh.co.uk >
<http://www.andyhsoftwa re.co.uk/space> Space: disk usage analysis tool

[Chung Leong]

Re: NeverEverNoSani ty WebWorm

"Avi Norowitz" <usenet@ulag.ne t> wrote in message
news:1103648482 .317136.36560@c 13g2000cwb.goog legroups.com...[color=blue]
> I encountered two servers this morning with this problem at the
> dedicated hosting company I work for. I suspect a worm is exploiting
> this vulnerability:
>
> http://www.hardened-php.net/advisories/012004.txt
>[/color]

A perfect example on why you shouldn't implement your own session handling
mechanism.

[CJ Llewellyn]

Re: NeverEverNoSani ty WebWorm FIX?


"ADoxx" <adoxx@hotmail. com> wrote in message
news:pan.2004.1 2.21.18.48.49.4 96390@hotmail.c om...[color=blue]
> Ok everyone, here it is....
>
> After taking heed of Bigcoupe's suggestion on a possible phpBB
> vulnerability, I downloaded version 2.0.11 (we were running 2.0.8) and
> patched it. We are also on PHP 4.3.10 as well. This is the highest our CMS
> will allow us to go, as well as Zend Optimizer (it won't let us use
> hardened-PHP). I've got our boards currently disabled and everything seems
> to be ok, but will enable them soon to further test.
>
> On that same note, on the phpBB site, there are a few threads of interest:
>
> http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240513 (the 2.0.11 update
> does this for you actually)
> http://www.phpadvisory.com/advisories/view.phtml?ID=42
>[/color]

http://www.phpbb.com/phpBB/viewtopic.php?t=248811&highlight=neverevernosanit

y[color=blue]
>[/color]

http://www.phpbb.com/phpBB/viewtopic.php?t=241300&highlight=neverevernosanit

y[color=blue]
> (this one is a sticky)
>[/color]

http://www.phpbb.com/phpBB/viewtopic.php?t=248539&highlight=neverevernosanit

y[color=blue]
>
> I will post more as I find out if you like. I know its a bit off topic
> here, but hoping it might help someone else with the same issue.
>
> Adam
>[/color]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Technical Cyber Security Alert TA04-356A
Exploitation of phpBB highlight parameter vulnerability

Original release date: December 21, 2004
Last revised: --
Source: US-CERT

Systems Affected

phpBB versions 2.0.10 and prior

Overview

The software phpBB contains an input validation problem in how it
processes a parameter contained in URLs. An intruder can deface a
phpBB website, execute arbitrary commands, or gain administrative
privileges on a compromised bulletin board.

I. Description

phpBB is an open-source bulletin board application. It fails to
properly perform an urldecode() on the "highlight" parameter supplied
to viewtopic.php. This may allow a remote attacker to execute
arbitrary commands on a vulnerable server.

According to reports, this vulnerability is being actively exploited
by the Santy.A worm. The worm appears to propogate by searching for
the keyword "viewtopic. php" in order to find vulnerable sites.

The worm writes itself to a file named "m1ho2of" on the compromised
system. It then overwrites files ending with .htm, .php, .asp. shtm,
.jsp, and .phtm replacing them with HTML content that defaces the web
page. The worm then tries to use PERL to execute itself on the
compromised system and propogate further.
US-CERT is tracking this issue as:

VU#497400 - phpBB viewtopic.php fails to properly sanitize input
passed to the "highlight" parameter

II. Impact

A remote attacker may be able to deface a phpBB website and execute
arbitrary commands on a compromised bulletin board.

III. Solution

Upgrade phpBB

Upgrade to phpBB verison 2.0.11 to prevent exploitation.

Appendix A. References

* US-CERT Vulnerability Note VU#497400 -
<http://www.kb.cert.org/vuls/id/497400>
* phpBB Downloads - < http://www.phpbb.com/downloads.php>
* phpBB Announcement -
<http://www.phpbb.com/phpBB/viewtopic.php?f =14&t=240636>
* Symantec Security Response - Perl.Santy -
<http://securityresponse.symantec.com...ata/perl.santy
.html>
* McAfee - Computer Virus Software and Internet Security -
<http://us.mcafee.com/virusInfo/defau...ption&virus_k=
130471>
_______________ _______________ _______________ _______________ _____

This vulnerability was reported by the phpBB Development Team.
_______________ _______________ _______________ _______________ _____

Feedback can be directed to the authors: Jeffrey Gennari and
Jason Rafail
_______________ _______________ _______________ _______________ _____

This document is available from:

<http://www.us-cert.gov/cas/techalerts/TA04-356A.html>

_______________ _______________ _______________ _______________ _____

Copyright 2004 Carnegie Mellon University.

Terms of use: <http://www.us-cert.gov/legal.html>
_______________ _______________ _______________ _______________ _____

Revision History

Dec 21, 2004: Initial release

Last updated December 21, 2004
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBQci1ihh oSezw4YfQAQLarQ f/cyzsvhFzCnqDyzR RqccGx8yG+AUMLQ nG
C+eZ3oyfEntqJkM h4ApNb1er8F+7Bk HNnhzvPeifqDQPM GwpjLrBnyPr4vSn eG3v
JBregSqACGHzR7/TDeDJ94kiBFPty7 7AS5r6eqsLe0uea L2kA149lEEcbGjP Gd+q
P0my0Jxkal0DPOw GuPyFIcjdGBAYHX qyCbI0hl6DqGGj/vSRkuhjt5EY0K7S hOdV
JaSmRWgkbM0vXtK j+sWCSOLFoDschF zlW+Egke17xf3bI ZUwvx5uNsw8AXZw Ciaa
CJNJcL+sI8JvXEQ qC5xiAkYgUVDA+W zRGtKoVfkEJBpv8 PS0MyhX+Q==
=ZLLn
-----END PGP SIGNATURE-----