This is a security advisary. Be warned ladies and gentlemen that this hacker has already defaced over 8,000 websites in a matter of days and he is making his rounds. Sould you be so unfortunate to have your box targetted, a mass defacement of all websites on your server will occur.

It seems that cPanel servers running CentOS and RHEL are currently being targetted, but there could be other distro's and control panels involved. It is also believed that this is being done via the system kernel v 2.6 version unknown.

If you have not done so, ensure that your /tmp and /dev/shm partitions are mounted nosuid,noexec to reduce the likelyhood that this script can be executed. Note, once the hacker accesses your server he creates a user account on your server called rOOt and creates a password for it. Search your /etc/passwd file to ensure that rOOt doesnt already exist.

There is no indication that there is an available patch at this time. Your best course of action is to make sure that each and every website is backed up on a nightly basis until a patch or fix is released by RH. You are advised to view every site on your server to ensure that he has not already attempted to deface a website on your server.

If you are experienced in compiling your own kernel source, now would be a good time to do so. Recompiling the kernel source from the latest distro seems to do that trick so if you are master in the art of recompiling your own kernel source, this is your best protection at this time.

Do not ignore this warning!!!

You may view his doings here. Click on a few websites to reveal the defaced websites.

http://www.zone-h.com/component/opti...acer,JaMaYcKa/

At this time it seems FreeBSD servers, the BSD kernel is not affected by this exploit but thats only a preliminary guess as there is no evidenance to support that any FreeBSD boxes have been rooted.

Thank you.

here are some site that have been hack

http://www.zone-h.com/component/opti...acer,JaMaYcKa/

Sounds like a hoax

Why does this look familiar?

http://forums.theplanet.com/index.php?showtopic=86029


Kind of late with the news if it even is true.

just try to help thats all !

Thanks dbosch. Gesture appreciated. No matter if its little delayed or a hoax, its always better to check server settings. Little effort here saves a lot of time later.

Thanks for the heads up even if it is old news.

I have nothing, so I am not affraid of him.

Lucky you are then.

Thanks for the heads up. I know if I was running a hosting biz, I'd look into this more. Usually managed servers are pretty good with security updates and security patches. I think if your not too knowledgeable in security issues with servers, that you for sure read and look into it. I remember working with a company and one of the servers was hacked. All because someone was too lazy to update apache, so always be sure everything is up to date and all ports or holes left open are closed off most of the time.

thanks for the info