ISC Diary

Handler on Duty:
Daniel Wesemann
Contact Us

JBoss Worm

Published: 2011-10-21,
Last Updated: 2011-10-21 02:06:15 UTC
by Johannes Ullrich (Version: 2)

A worm is making the round infecting JBoss application servers. JBoss is an open source Java based application server and it is currently maintained by RedHat.

The worm exploits and older configuration problem in JBoss, which only authenticated GET and POST requests. It was possible to use other methods to execute arbitrary code without authentication. The problem has been fixed last year, but there are apparently still a number of vulnerable installs out there.

If you do run JBoss, please make sure to read the instructions posted by RedHat here:

http://community.jboss.org/blogs/mjc/2011/10/20/statement-regarding-security-threat-to-jboss-application-server

Analysis of the worm:

http://pastebin.com/U7fPMxet

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

Keywords: jboss

2 comment(s)

Top of page

Comments

From what I can see, the two hosts listed in the perl code do not actually resolve to an address so cannot be connected to at his point.
Maybe they will become active in time.

posted by LCV, Mon Oct 24 2011, 00:55

LCV> I'm pretty sure that due to the disclosure of the source code you'll find new variations of worm and new (script kiddie) domains.

posted by Vadim, Tue Oct 25 2011, 13:51

New Comments closed for all Diaries older than two(2) weeks
Please send your comments to our Contact Form