Return-Path: Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm Delivered-To: mailing list tomcat-user@jakarta.apache.org Received: (qmail 76231 invoked from network); 23 Nov 2000 05:56:20 -0000 Received: from web2305.mail.yahoo.com (128.11.68.80) by locus.apache.org with SMTP; 23 Nov 2000 05:56:20 -0000 Message-ID: <20001123055618.13310.qmail@web2305.mail.yahoo.com> Received: from [211.5.153.92] by web2305.mail.yahoo.com; Wed, 22 Nov 2000 21:56:18 PST Date: Wed, 22 Nov 2000 21:56:18 -0800 (PST) From: Andy Watts Subject: Security: hacker uploading files via catalina To: tomcat-user@jakarta.apache.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-243268139-974958978=:7805" X-Spam-Rating: locus.apache.org 1.6.2 0/1000/N --0-243268139-974958978=:7805 Content-Type: text/plain; charset=us-ascii Hi, Over the last week someone has been able to upload files to my document root. The file names are freechat.asp, getlatest.glh, chat_a.cgi. The files are appear pretty useless, however it is the mechanism that allowed them to be uploaded which worries me. I know for sure that the files are being uploaded by http. If anyone has any ideas, I'd greatly appreciate the help. -Aandy --------------------------------- Do You Yahoo!? Yahoo! Shopping - Thousands of Stores. Millions of Products. --0-243268139-974958978=:7805 Content-Type: text/html; charset=us-ascii

Hi,

Over the last week someone has been able to upload files to my document root.  The file names are freechat.asp, getlatest.glh, chat_a.cgi.  The files are appear pretty useless, however it is the mechanism that allowed them to be uploaded which worries me.

I know for sure that the files are being uploaded by http. 

If anyone has any ideas, I'd greatly appreciate the help.

-Aandy


Do You Yahoo!?
Yahoo! Shopping - Thousands of Stores. Millions of Products. --0-243268139-974958978=:7805--