NeverEverNoSanity WebWorm

[ADoxx]

Just a quick question for anyone in the know... many websites are being
defaced for the last day or so with a worm called "NeverEverNoSanity
WebWorm". We have two sites affected (and down) by it right now and we are
under the assumption it is PHP that is the door for it to get in. Of
course we could be completely way off base, but I thought I'd throw this
out to this news group just in case. If anyone has any info or might know
the cure please please respond.... many thanks!

AMD

[Bigcoupe]

I have the same problem.
Do you run phpBB? I suspect this is how they are defacing the sites

[ADoxx]

On Tue, 21 Dec 2004 08:33:50 -0800, Bigcoupe wrote:

I have the same problem.
Do you run phpBB? I suspect this is how they are defacing the sites

Indeed we do. We run phpBB2, but also a commercial CMS package. Both were
affected. Basically it overwrote *every* .php file on the server with it's
own HTML content. What leads you to think its phpBB? Not doubting you,
just curious.. maybe you've found something we havent. According to our
logs, the server itself wasn't breached, only web content (namely PHP
files). Hope this helps. I can give more info to anyone who requests :)

[tcd004]

I have the same problem. I also run phpbb.

My host did a full site restore. The site was back up for about 5
minutes, and whammo, the worm executed again.

tcd004

ADoxx wrote:

On Tue, 21 Dec 2004 08:33:50 -0800, Bigcoupe wrote:

I have the same problem.
Do you run phpBB? I suspect this is how they are defacing the

sites
Indeed we do. We run phpBB2, but also a commercial CMS package. Both were affected. Basically it overwrote *every* .php file on the server with it's own HTML content. What leads you to think its phpBB? Not doubting you, just curious.. maybe you've found something we havent. According to our logs, the server itself wasn't breached, only web content (namely PHP
files). Hope this helps. I can give more info to anyone who requests

:)

[ADoxx]

On Tue, 21 Dec 2004 08:51:00 -0800, tcd004 wrote:

I have the same problem. I also run phpbb.

My host did a full site restore. The site was back up for about 5
minutes, and whammo, the worm executed again.

I am thinking we are getting OT here, but this is ok since someone else
might come to this group looking for answers just as I did... but I think
I found a fix. Will post here if it works! :)

[Bigcoupe]

Well, there was both a PHP and a phpBB security release last week.
This is what leads me to believe that it was a combo of both. I
upgraded and it happened again. After looking into things a bit more,
I did find these:

home.php
r57.php
r57.php?

All with the same dates and in Apache's doc root. The r57.php script
allowed ANY command to be run on the server!.
I have cleaned up but am watching it closely.

[Avi Norowitz]

I encountered two servers this morning with this problem at the
dedicated hosting company I work for. I suspect a worm is exploiting
this vulnerability:

http://www.hardened-php.net/advisories/012004.txt

The PHP website strongly encourages users to upgrade to PHP 4.3.10 or
5.0.3, presumably because of the above vulnerability:

http://www.php.net/

ADoxx wrote:

Just a quick question for anyone in the know... many websites are being defaced for the last day or so with a worm called "NeverEverNoSanity
WebWorm". We have two sites affected (and down) by it right now and we are under the assumption it is PHP that is the door for it to get in. Of
course we could be completely way off base, but I thought I'd throw this out to this news group just in case. If anyone has any info or might know the cure please please respond.... many thanks!

AMD

[ADoxx]

Ok everyone, here it is....

After taking heed of Bigcoupe's suggestion on a possible phpBB
vulnerability, I downloaded version 2.0.11 (we were running 2.0.8) and
patched it. We are also on PHP 4.3.10 as well. This is the highest our CMS
will allow us to go, as well as Zend Optimizer (it won't let us use
hardened-PHP). I've got our boards currently disabled and everything seems
to be ok, but will enable them soon to further test.

On that same note, on the phpBB site, there are a few threads of interest:

http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240513 (the 2.0.11 update
does this for you actually)
http://www.phpadvisory.com/advisories/view.phtml?ID=42
http://www.phpbb.com/phpBB/viewtopic...erevernosanity
http://www.phpbb.com/phpBB/viewtopic...erevernosanity
(this one is a sticky)
http://www.phpbb.com/phpBB/viewtopic...erevernosanity

I will post more as I find out if you like. I know its a bit off topic
here, but hoping it might help someone else with the same issue.

Adam

[Avi Norowitz]

After performing some additional research I have found that the problem
seems to be a phpBB vulnerability rather than a PHP vulnerability.

A security vulnerability has recently been discovered in phpBB 2.0.10
and earlier versions. Further, a worm recently began circulating that
exploits vulnerable versions of phpBB. If you are using phpBB, then you
should upgrade to phpBB 2.0.11 to secure this vulnerability.

You can find more information about the recent phpBB security
vulnerability and the worm at the websites below:

http://www.kaspersky.com/news?id=156681162
http://www.securiteam.com/unixfocus/6J00O15BPS.html
http://www.phpbb.com/phpBB/viewtopic.php?t=244451
http://www.phpbb.com/phpBB/viewtopic.php?t=248811

[mazdaf]

So the fix is to update phpbb and PHP, or add a fix to viewfiles.php.
This will prevent further attacks by this worm, correct?
Isn't this a worm, does the worm still exist on the server, if so how
can it be found and deleted?

[LarryD]

It seems to be a PHP vulnerability as our UBB was also effected. I
changed the permissions to 600 (owner-only rights) and the files were
still altered/replaced.

[Andy Hassall]

On Tue, 21 Dec 2004 06:59:17 -0800, ADoxx <ad***@hotmail.com> wrote:

Just a quick question for anyone in the know... many websites are being
defaced for the last day or so with a worm called "NeverEverNoSanity
WebWorm". We have two sites affected (and down) by it right now and we are
under the assumption it is PHP that is the door for it to get in. Of
course we could be completely way off base, but I thought I'd throw this
out to this news group just in case. If anyone has any info or might know
the cure please please respond.... many thanks!

http://www.theregister.co.uk/2004/12/21/santy_worm/
http://www.kaspersky.com/news?id=156681162

Says it's a phpBB vulnerability, fixed in 2.0.11.

--
Andy Hassall / <an**@andyh.co.uk> / <http://www.andyh.co.uk>
<http://www.andyhsoftware.co.uk/space> Space: disk usage analysis tool

[Chung Leong]

"Avi Norowitz" <us****@ulag.net> wrote in message
news:11*********************@c13g2000cwb.googlegro ups.com...

I encountered two servers this morning with this problem at the
dedicated hosting company I work for. I suspect a worm is exploiting
this vulnerability:

http://www.hardened-php.net/advisories/012004.txt

A perfect example on why you shouldn't implement your own session handling
mechanism.

[CJ Llewellyn]

"ADoxx" <ad***@hotmail.com> wrote in message
news:pa****************************@hotmail.com...

Ok everyone, here it is....

After taking heed of Bigcoupe's suggestion on a possible phpBB
vulnerability, I downloaded version 2.0.11 (we were running 2.0.8) and
patched it. We are also on PHP 4.3.10 as well. This is the highest our CMS
will allow us to go, as well as Zend Optimizer (it won't let us use
hardened-PHP). I've got our boards currently disabled and everything seems
to be ok, but will enable them soon to further test.

On that same note, on the phpBB site, there are a few threads of interest:

http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240513 (the 2.0.11 update
does this for you actually)
http://www.phpadvisory.com/advisories/view.phtml?ID=42
http://www.phpbb.com/phpBB/viewtopic...verevernosanit
y http://www.phpbb.com/phpBB/viewtopic...verevernosanit
y (this one is a sticky)
http://www.phpbb.com/phpBB/viewtopic...verevernosanit
y
I will post more as I find out if you like. I know its a bit off topic
here, but hoping it might help someone else with the same issue.

Adam

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Technical Cyber Security Alert TA04-356A
Exploitation of phpBB highlight parameter vulnerability

Original release date: December 21, 2004
Last revised: --
Source: US-CERT

Systems Affected

phpBB versions 2.0.10 and prior

Overview

The software phpBB contains an input validation problem in how it
processes a parameter contained in URLs. An intruder can deface a
phpBB website, execute arbitrary commands, or gain administrative
privileges on a compromised bulletin board.

I. Description

phpBB is an open-source bulletin board application. It fails to
properly perform an urldecode() on the "highlight" parameter supplied
to viewtopic.php. This may allow a remote attacker to execute
arbitrary commands on a vulnerable server.

According to reports, this vulnerability is being actively exploited
by the Santy.A worm. The worm appears to propogate by searching for
the keyword "viewtopic.php" in order to find vulnerable sites.

The worm writes itself to a file named "m1ho2of" on the compromised
system. It then overwrites files ending with .htm, .php, .asp. shtm,
.jsp, and .phtm replacing them with HTML content that defaces the web
page. The worm then tries to use PERL to execute itself on the
compromised system and propogate further.
US-CERT is tracking this issue as:

VU#497400 - phpBB viewtopic.php fails to properly sanitize input
passed to the "highlight" parameter

II. Impact

A remote attacker may be able to deface a phpBB website and execute
arbitrary commands on a compromised bulletin board.

III. Solution

Upgrade phpBB

Upgrade to phpBB verison 2.0.11 to prevent exploitation.

Appendix A. References

* US-CERT Vulnerability Note VU#497400 -
<http://www.kb.cert.org/vuls/id/497400>
* phpBB Downloads - < http://www.phpbb.com/downloads.php>
* phpBB Announcement -
<http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240636>
* Symantec Security Response - Perl.Santy -
<http://securityresponse.symantec.com...ata/perl.santy
.html>
* McAfee - Computer Virus Software and Internet Security -
<http://us.mcafee.com/virusInfo/defau...ption&virus_k=
130471>
__________________________________________________ _______________

This vulnerability was reported by the phpBB Development Team.
__________________________________________________ _______________

Feedback can be directed to the authors: Jeffrey Gennari and
Jason Rafail
__________________________________________________ _______________

This document is available from:

<http://www.us-cert.gov/cas/techalerts/TA04-356A.html>

__________________________________________________ _______________

Copyright 2004 Carnegie Mellon University.

Terms of use: <http://www.us-cert.gov/legal.html>
__________________________________________________ _______________

Revision History

Dec 21, 2004: Initial release

Last updated December 21, 2004
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBQci1ihhoSezw4YfQAQLarQf/cyzsvhFzCnqDyzRRqccGx8yG+AUMLQnG
C+eZ3oyfEntqJkMh4ApNb1er8F+7BkHNnhzvPeifqDQPMGwpjL rBnyPr4vSneG3v
JBregSqACGHzR7/TDeDJ94kiBFPty77AS5r6eqsLe0ueaL2kA149lEEcbGjPGd+q
P0my0Jxkal0DPOwGuPyFIcjdGBAYHXqyCbI0hl6DqGGj/vSRkuhjt5EY0K7ShOdV
JaSmRWgkbM0vXtKj+sWCSOLFoDschFzlW+Egke17xf3bIZUwvx 5uNsw8AXZwCiaa
CJNJcL+sI8JvXEQqC5xiAkYgUVDA+WzRGtKoVfkEJBpv8PS0My hX+Q==
=ZLLn
-----END PGP SIGNATURE-----