httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Matus UHLAR - fantomas <uh...@fantomas.sk>
Subject Re: [users@httpd] NeedHelp
Date Wed, 20 Sep 2006 17:32:12 GMT
On 19.09.06 14:23, Igor V. Ruzanov wrote:
> I use Apache/1.3.28 web-server under FreeBSD 5.2.1-RELEASE within jail
> environment. And there is some strange thing when i'm checking
> http-processes by `ps lax':

> >  80 69523     1   0  96  0  6148 1232 select SLsJ  ??    0:00.49 (httpd)

> The string `80 83454     1   0  96  0  6148 1232 select SLsJ  ??
> 0:00.49 (httpd)'
> is confused me because i don't know what is the process (httpd) (it seems
> to be there is parent process with PPID=1). And the following picture is
> appearing when i do the `sockstat| grep http' command:

> > www      httpd      69523 5  tcp4   217.144.97.27:53407   84.19.182.61:6667

> Same process is in the string `www      httpd      69523 5  tcp4
> 217.144.97.27:53407   84.19.182.61:6667'. Its not difficult to see that we
> deal with tcp-connection to irc-server.
> Could you please help me to anderstand such behaviour of Apache-server, is
> it normal situation or maybe its a some vulnerability of my version of
> Apache?

It seems that someone abused a security bug in one of your webs/scripts
-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Save the whales. Collect the whole set.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message