Security exploit - sending thousands of emails

Involved Joined: Sep 22, 2003 Posts: 252

This is the email I got from my host:

Quote:

We had to temporarily suspend your site because we believe the php script there was again being exploited and used to send thousands of spam emails. This has been occurring frequently over the past few days...probably 5 times since Saturday. One time recently it crashed the server and we had to reboot, other times it bogged the server down to where it could barely serve up webpages.

Do you know if your script has any new patches? If not you will need to report it to the creators of the script and hopefully they have a fix for it.

I am running nuke 7.0 with Chatservs latest patches. Also running sentinel 2.0.1 Is this a common problem?

Posted: Tue Aug 23, 2005 9:32 am

I would start by upgrading your sentinel version. 2.0.1 is VERY old.

Posted: Tue Aug 23, 2005 10:57 am

I know 4 or 5 Nuke sites with different versions between Nuke 6.5 and 7.3. with the same problem.If you have webmail installed delete it, if you are using awstats upgrade to version 6.5.Check your mail configuration and you can also upgrade NukeSentinel. (only two of the sites I´m talking about used Sentinel).

But its really hard to find out where the security hole is. One webmaster of the 5 told me after he upload his files again (2 or 3 weeks later) it goes on with 1000 of spam mails.

It´s sometimes to look for a needle in a haystack. Good luck !

Posted: Tue Aug 23, 2005 4:03 pm

I am using NSN 2.0.1 and have never upgraded before. Do I do a sequential upgrade or can I just upgrade to the current version?

Regular Joined: Jun 15, 2005 Posts: 78 Location: AR

They use the webmail module so that the email comes from your server. You need to delete the webmail module. I highly recommend this to anyone using nuke period. I had the same problem a WHILE back.

Site Admin Joined: Jun 04, 2004 Posts: 6432

You upload the new Sentinel file once, then upgrade the database / tables sequentially - one step at a time from one version to the next. Not very difficult, and I've never had problems upgrading.

Also, the host didn't specifically tell you it was PHP or PHP-Nuke (though I'd still remove the webmail module if you have it - was it still included in 7.0??). But you should also check other directories like cgi-bin to see if there are any sendmail.pl or mail related scripts there. Most hosts either remove that or upgrade it to a safer version, but you don't need it on a Nuke site, so remove that if it's there.

Regular Joined: Mar 18, 2006 Posts: 60

The only module i see is feedback, is this one safe?
Running rn76v2.02

Posted: Mon Mar 27, 2006 8:39 pm

For the most part, yes. I think rn76v2.02 uses the enhanced feedback module that VinDSL wrote, which is pretty secure.