Honeypot Compromises I
Some time ago I blogged about several compromises at our honeypots deployed in Germany. Now it is time for an update and a closer look at what happened during these incidents. Today we will take a closer look at the compromise of a Suse 9.1 honeypot with a vulnerable Horde Framework. The attacked installed several scripts on the honeypot and also tried to set up a phishing web site.
Motivation:
On May 5th 2006 our Suse 9.1 based Honeypot was attacked and successfully compromised by exploiting a vulnerable web application, the Horde Application Framework. The vulnerability could be exploited by a remote attacker to execute arbitrary commands with the privileges of the running Apache webserver process. This flaw is due to an input validation error in the help viewer of the application. The vulnerability was first discovered in March 2006 and affects all Horde Application Framework versions prior to 3.1.1.
The full analysis was written by Jan Göbel during his thesis work.
Motivation:
On May 5th 2006 our Suse 9.1 based Honeypot was attacked and successfully compromised by exploiting a vulnerable web application, the Horde Application Framework. The vulnerability could be exploited by a remote attacker to execute arbitrary commands with the privileges of the running Apache webserver process. This flaw is due to an input validation error in the help viewer of the application. The vulnerability was first discovered in March 2006 and affects all Horde Application Framework versions prior to 3.1.1.
The full analysis was written by Jan Göbel during his thesis work.
".
