Correct... I went out and looked at the file, then did some research on the
virus itself, and, it doesn't (luckily) comes from our Tomcat 3.2.1
distribution (I'm paranoia mode right now!). The file is totally harmless
and it seems that "Casper" has a SunOS box which has been infected...
2 hours wasted... What-EVER! :)
Pier
Casper Gjerris at [EMAIL PROTECTED] wrote:
> Hi Pier,
>
> I just picked up
> tomcat-3.2.1.zip
> tomcat-3.2.1.tar.gz
> tomcat.zip (from the nigthly 3.3)
>
> And none of them seems to have any problems with index.html.
>
> It seems to me that you have already fixed the problem or that "casper" in
> taiwan has been hacked himself.
>
> Regards
> Casper Gjerris
>
>
>
>
> ----- Original Message -----
> From: "Pier P. Fumagalli" <>
> To: <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>
> Sent: Thursday, May 24, 2001 12:18 PM
> Subject: FW: question
>
>
> Here's what it seems they did with the exploit... Rerolling the binaries
> *balls of Tomcat putting a new index.htm...
>
> I'm downloading the supposedly wrong binary as we speak, but it's kinda slow
> from my 56kbps connection...
>
> Fuck shit...
>
> Pier
>
> ------ Forwarded Message
> From: "casper"<[EMAIL PROTECTED]>
> Reply-To: "casper"<[EMAIL PROTECTED]>
> Date: Thu, 24 May 2001 14:07:14 +0800
> To: "webmaster @ jakarta . apache . org" <[EMAIL PROTECTED]>
> Subject: question
>
> Hi
>
> I download tomcat3.2.1 version software but when i to set my file in the
> \webapps .I find one file and file name is index.htm and this file is from
> china.
> i send this file to you,pls to check your server is okay and i have check my
> server is no any hacker.
> I download file date is 2001/05/23.
> If it's right pls send mail to me.
>
> thanks
> Casper
>
>
> --------------------------------------------------------------------
> ??????·????? http://mail.kimo.com.tw
> < ? ? ? ?·? ? ? ? > http://www.kimo.com.tw
>
>
>
> ------ End of Forwarded Message
>
>
