Possible breach

Mig21 · 07-05-2005, 05:14 PM

hello

i had some trouble upgrading packages on a slackware 10.1 box i installed yesterday. i looked in my /var/log/messages and luckily noticed this. i have no clue how it may have gotten there

is this the sgnature of a hacker or a bug in an application?

Code:

head -1500 messages | tail -100

gives me this: http://littlesvr.ca/misc/littlesvr-messages.txt

which is only mildly interesting, here's how it looks in a 111/43 char terminal

http://littlesvr.ca/misc/littlesvr-messages-1.png
http://littlesvr.ca/misc/littlesvr-messages-2.png
http://littlesvr.ca/misc/littlesvr-messages-3.png
http://littlesvr.ca/misc/littlesvr-messages-4.png

what an upgrade..

thanks

Krugger · 07-05-2005, 07:07 PM

That is kind of weird. What you got in your messages is the code of phpBB possibly version 2.0.12.

Now what it is doing in your messages I don't know. Maybe that is related to you upgrade problem.

Anyway if you want to check it out it is in includes/usercp_confirm.php.

Mig21 · 07-05-2005, 08:43 PM

strange indeed. i have the latest phpbb on there (2.0.16) but php should write errors to the apache log. and this is not an error, it's possibly a buffer overflow.

oh i remember i forgot to restore my database and went to the forum site. maybe that's when it happened. but why the messages file?

anyway, false alarm.

cheers