Linux Worm Exploits PHP XMLRPC Vulnerability

There are few reports of an attack by a new Linux worm called Lupper which exploits a well known PHP XMLRPC implementation vulnerability.

PHP XMLRPC implementation is used in a large number of popular web applications such as PostNuke, Drupal, b2evolution, Xoops, PHPGroupWare, TikiWiki etc.

Most of these packages have updated to provide a patch for the XMLRPC for PHP vulnerability.

If you are still running an old version, you should get it updated immediately.

WordPress 1.5 or higher is safe from this worm. Since the release of version 1.5, WordPress has used a completely different XML-RPC library, called IXR.

From the submitted logs, it attempts to wget a remote access Trojan from one system and using the Trojan to try to connect to another site via port 8080.

The risk factor is low so far. It is however interesting as it is the first known case of exploitation of the vulnerability as a worm.

Link