11

I have an Ubuntu Server 12.04 installed on a VM. This server has apache2-mpm-prefork Install apache2-mpm-prefork and libapache2-mod-php5 Install libapache2-mod-php5 installed. I was looking through the logs and recently came across these rather suspicious entries:

xx.xx.xx.xx - - [20/Jan/2014:09:00:04 +0000] "HEAD / HTTP/1.0" 200 274 ...
xx.xx.xx.xx - - [20/Jan/2014:09:00:23 +0000] "POST /cgi-bin/php?%2D%64+...
xx.xx.xx.xx - - [20/Jan/2014:09:00:25 +0000] "POST /cgi-bin/php5?%2D%64...
...

Decoding the content after php?... results in the following:

-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d
  disable_functions="" -d open_basedir=none -d
  auto_prepend_file=php://input -d cgi.force_redirect=0 -d
  cgi.redirect_status_env=0 -n

Is this something I should be concerned about?

1 Answer 1

10

Is probably a old Zero Day attack targeting Parallels Plesk Panel. If you are not running it, you should be pretty safe. This is a quote about how the attack is done from Computer World:

A command executed by the exploit contains several arguments that are intended to disable security mechanisms that might exist on the server, he said. These include the “allow_url_include=on” argument which allows the attacker to include arbitrary PHP code and the “safe_mode=off” argument. “As a final step Suhosin, a PHP hardening patch, is put into simulation mode. This mode is designed for application testing, and effectively turns off the extra protection.”

In the POST request we can see the 3 vertices of the attack, which is in fact the first 3 commands sent -d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on. The rest is just crawling more in your server.

You may want to know more about the CVE-2012-1823 that address this issue. Parallels provided a workaround to protect their users/costumers. This issue has been fixed in all versions of Ubuntu, only old unmaintained servers are in danger. If you are using version equal or superior than 5.3.10-1ubuntu3.1 of php5-cgi, you are out of danger.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .