Linux Lupper Worm Found in the Wild
Bookmark on del.icio.us or FurlMcAfee has posted details on a relatively new Linux Worm that has been found in the wild. Called Linux / Lupper.worm, this is a variant of the Linux / Slapper and BSD / Scalper worms and it propagates using the same methods as these worms.
The worm spreads by infecting Web Servers that are hosting vulnerable PHP and CGI Scripts, most notably the XMLRPC PHP Library used by many CMS and Blogging platforms and the AWStats Log Analyzer Script. Infected servers scan for other vulnerable machines and attempt to spread the worm by sending malicious http requests to port 80. If another server is found running one of the vulnerable scripts, then an attempt is made to downoad the worm to this server and execute it.
This is just another good reason why all Linux Web Servers should be running some sort of outbound firewall protection — similar to a Zonealarm or other personal firewall. Most web servers (Linux or not) are setup to blindly allow all outbound traffic on any port. There are scripts out there for Linux — I’m not sure about other operating systems — that are relatively easy to install and will allow you to specify which outbound traffic to allow and block and log all other traffic. It would be much more difficult for these worms to spread if something like this was setup on the web server. Even better is to also check the application that the traffic is originating from — but I don’t know if there is anything for Linux Web Servers like this available.
Technorati Tags: Linux, Web Server, Security
If you liked this article, buy me a beer!