Site Links
Home
Features
Documentation
Pricing & Order
Members Area
Support Options
UBBDev.com
UBBWiki.com
Who's Online Now
2 registered members (TheBrit, isaac), 98 guests, and 300 spiders.
Key: Admin, Global Mod, Mod
Member Spotlight
Posts: 467
Joined: August 2004
Show All Member Profiles 
Top Posters(30 Days)
Gizmo 17
isaac 9
SteveS 8
Morgan 5
Ruben 4
jorb 4
Zarzal 2
Latest Photos
Test
Testing to drag photos
Comfortable Cats
Test
BSA photos
Previous Thread
Next Thread
Print Thread
[NOTABUG] Net.Worm.Perl.Santy-A #113880
12/21/04 06:15 PM
12/21/04 06:15 PM
H
Hertz  Offline OP
stranger
Joined: Sep 2004
Posts: 1
We've had 6.7.2 breached by this worm:

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1036174,00.html

The only crucial file it got was ultimatebb.php, but that's enough to bring down most the board....

Any suggestions?

Express Hosting
Express Hosting "We are the official hosting company of UBB.threads. Ask us about our free migration services to migrate your UBB.threads installation."
Re: [NOTABUG] Net.Worm.Perl.Santy-A #113881
12/21/04 06:27 PM
12/21/04 06:27 PM
David Dreezer  Offline

Pooh-Bah
Joined: Jul 2006
Posts: 2,199
UBB.classic is not a vector for this worm - it only infects phpBB boards.

The worm, once attached to the board, proceeds to scour the server for writable files with certain extensions, which then proceed to get overwritten with the worm's message.

Your server has a phpBB running on it somewhere that was infected, and proceeded to jump boundaries into your account (and surely everyone else's on that server) and do its work.

Again, there is no way for UBB.classic (or UBB.threads) to be a vector for this worm.


This thread for sale. Click here! [Linked Image]
Re: [NOTABUG] Net.Worm.Perl.Santy-A #113882
12/26/04 08:00 PM
12/26/04 08:00 PM
U
Unnet Board Guy  Offline
newbie
Joined: Aug 2004
Posts: 28
Hi Charles and brushiefish,

I had two ubb.classic forums that are no longer up because of something ? I'm not certain if it's this worm or not, but I've taken them both down and had to have the server re-built. I wasn't using a php database or anything else that I think could have been compromised. Just html and the ubb classic forum. I'm not an expert by any means but .... there it is.

Re: [NOTABUG] Net.Worm.Perl.Santy-A #113883
12/27/04 01:20 PM
12/27/04 01:20 PM
David Dreezer  Offline

Pooh-Bah
Joined: Jul 2006
Posts: 2,199
It is unlikely that the worm was the cause unless the file destruction matches that which is described in the article posted above.


This thread for sale. Click here! [Linked Image]
Re: [NOTABUG] Net.Worm.Perl.Santy-A #113884
12/28/04 10:25 AM
12/28/04 10:25 AM
U
Unnet Board Guy  Offline
newbie
Joined: Aug 2004
Posts: 28
Hi Charles,

Thank you for your reply. You may want to read this article:

http://www.computerworld.com/securitytopics/security/holes/story/0,10801,98553,00.html?from=homeheads

Sincerely

Re: [NOTABUG] Net.Worm.Perl.Santy-A #113885
12/28/04 10:26 AM
12/28/04 10:26 AM
U
Unnet Board Guy  Offline
newbie
Joined: Aug 2004
Posts: 28
::
Early versions of the Santy worm exploited a specific bug in a bulletin-board software package called phpBB, and their attacks could be prevented by applying a patch to the software (see story). However, the security flaw exploited by newer versions of the worm such as Santy.C or Santy.E is more general, and can occur anywhere a site designer has left the door open for the inclusion of arbitrary files into PHP scripts, experts at K-OTik Security in Montpellier, France, warned.

Re: [NOTABUG] Net.Worm.Perl.Santy-A #113886
12/28/04 02:32 PM
12/28/04 02:32 PM
David Dreezer  Offline

Pooh-Bah
Joined: Jul 2006
Posts: 2,199
No Infopop products are vulnerable to any existing version of the Santy worm.


This thread for sale. Click here! [Linked Image]

Shout Box
Today's Birthdays
GoldenEye
Recent Topics
testing table layout
by TheBrit. 12/13/18 11:16 AM
header.php after update from 7.5.x to 7.6.x
by Zarzal. 12/12/18 05:29 AM
Does 7.6.2 support php 71?
by Baldeagle. 12/12/18 02:17 AM
Cannot contact support
by . 12/11/18 06:43 PM
errors importing a database
by andrewjs18. 12/11/18 03:51 AM
Forum Statistics
Forums36
Topics35,177
Posts191,658
Members12,122
Most Online978
Jun 24th, 2007
Random Image
Powered by UBB.threads™ PHP Forum Software 7.6.2