JBoss Worm
A worm is making the round infecting JBoss application servers. JBoss is an open source Java based application server and it is currently maintained by RedHat.
The worm exploits and older configuration problem in JBoss, which only authenticated GET and POST requests. It was possible to use other methods to execute arbitrary code without authentication. The problem has been fixed last year, but there are apparently still a number of vulnerable installs out there.
If you do run JBoss, please make sure to read the instructions posted by RedHat here:
http://community.jboss.org/blogs/mjc/2011/10/20/statement-regarding-security-threat-to-jboss-application-server
Analysis of the worm:
http://pastebin.com/U7fPMxet
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter
Network Monitoring and Threat Detection In-Depth | Singapore | Nov 18th - Nov 23rd 2024 |
Comments
Maybe they will become active in time.
LCV
Oct 24th 2011
1 decade ago
Vadim
Oct 25th 2011
1 decade ago