PGP SIGNED MESSAGE-----
CA-2002-27 Apache/mod_ssl Worm
release date: September 14, 2002
Last revised: --
revision history can be found at the end of this file.
systems running Apache with mod_ssl accessing SSLv2-enabled
OpenSSL 0.9.6d or earlier on Intel x86 architectures
has received reports of self-propagating malicious code
which exploits a vulnerability (VU#102795) in OpenSSL. This malicious
code has been referred to as Apache/mod_ssl worm, linux.slapper.worm
and bugtraq.c worm.
worm is self-propagating malicious code that
exploits the OpenSSL vulnerability described in VU#102795.
was the among the topics discussed in CA-2002-23
"Multiple Vulnerabilities In OpenSSL".
this OpenSSL server vulnerability exists on a wide variety of
platforms, the Apache/mod_ssl worm appears to work only on Linux
systems running Apache with the OpenSSL module (mod_ssl) on Intel
worm scans for potentially vulnerable systems on
80/tcp using an invalid HTTP GET request.
Apache system is detected, it attempts to send exploit code to
the SSL service via 443/tcp. If successful, a copy of the malicious
source code is then placed on the victim server, where the attacking
system tries to compile and run it. Once infected, the victim server
begins scanning for additional hosts to continue the worm's
the Apache/mod_ssl worm can act as an attack platform
for distributed denial-of-service (DDoS) attacks against other sites
by building a network of infected hosts. During the infection process,
the attacking host instructs the newly-infected victim to initiate
traffic on 2002/udp back to the attacker. Once this communications
channel has been established, the infected system becomes part of the
Apache/mod_ssl worm's DDoS network. Infected hosts can then share
information on other infected systems as well as attack instructions.
Thus, the 2002/udp traffic can be used by a remote attacker as a
communications channel between infected systems to coordinate attacks
on other sites.
indicate that the Apache/mod_ssl worm's source code is placed
in /tmp/.bugtraq.c on infected systems. It is compiled with gcc,
resulting in the executable binary being stored at /tmp/.bugtraq;
therefore, presence of any of the following files on Linux systems
running Apache with OpenSSL is indicative of compromise.
phase of the attack may show up in web server logs as:
the appearance of this entry in a web server log is not
indicative of compromise, but is merely evidence of a probe from an
received by the CERT/CC indicate that Apache systems may
subsequently log messages similar to the following:
SSL handshake failed: HTTP spoken on HTTPS port; trying
to send HTML error page (OpenSSL library error follows)
routines:SSL23_GET_CLIENT_HELLO:http request [Hint: speaking
HTTP to HTTPS port!?]
log entries may vary from system to system, but will generally
include an "SSL handshake failed" followed by an OpenSSL library
found to be listening for or transmitting data on 2002/udp are
also indicative of compromise by the Apache/mod_ssl worm.
Apache/mod_ssl worm activity on the network
systems are readily identifiable on a network by the
following traffic characteristics:
-- Scanning on 80/tcp
-- Connections to 443/tcp
-- Transmitting or receiving datagrams with both source and
destination ports 2002/udp. This traffic is used as a
communications channel between infected systems to coordinate
attacks on other sites.
infected hosts that are actively participating in DDoS
attacks against other systems may generate unusually high volumes of
attack traffic using various protocols (e.g., TCP, UDP, ICMP)
by the Apache/mod_ssl worm indicates that a remote attacker
can execute arbitrary code as the apache user on the victim system.
may be possible for an attacker to subsequently leverage a local
privilege escalation exploit in order to gain root access to the
victim system. Furthermore, the DDoS capabilities included in the
Apache/mod_ssl worm allow victim systems to be used as platforms to
attack other systems.
of all systems running OpenSSL are encouraged to review
CA-2002-23 and VU#102795 for detailed vendor recommendations regarding
while the vulnerability exploited by the Apache/mod_ssl worm
was fixed beginning with OpenSSL version 0.9.6e, as of this writing
the latest version of OpenSSL is 0.9.6g. Administrators may wish to
upgrade to that version instead.
is reproduced in part from CA-2002-23
to version 0.9.6e of OpenSSL
to version 0.9.6e of OpenSSL to resolve the issues
addressed in this advisory. As noted in the OpenSSL advisory,
separate patches are available:
patches for OpenSSL 0.9.6d:
either applying the patches above or upgrading to 0.9.6e,
recompile all applications using OpenSSL to support SSL or TLS
services, and restart said services or systems. This will eliminate
all known vulnerable code.
running OpenSSL pre-release version 0.9.7-beta2 may wish to
upgrade to 0.9.7-beta3, which corrects these vulnerabilities.
Separate patches are available as well:
patches for OpenSSL 0.9.7 beta 2:
SSLv2 handshaking will prevent exploitation of VU#102795.
CERT/CC recomends consulting the mod_ssl documentation for a complete
description of the options but one method for disabling SSLv2 is to
remove SSLv2 as a supported cipher in the SSLCipherSuite directive in
the configuration file. For example:
allows SSLv2 can be changed to
will disable SSLv2. Note the changing of +SSLv2 to !SSLv2.
systems may still be susceptible to the other vulnerabilities
described in CA-2002-23.
from a system compromise
believe a system under your administrative control has been
compromised, please follow the steps outlined in
is interested in receiving reports of this activity. If
machines under your administrative control are compromised, please
send mail to email@example.com with the following text included in the
subject line: "[CERT#23820]".
can be directed to the author: Allen Householder
is available from:
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
personnel answer the hotline 08:00-17:00 EST(GMT-5) /
EDT(GMT-4) Monday through Friday; they are on call for emergencies
during other hours, on U.S. holidays, and on weekends.
urge you to encrypt sensitive information sent by email.
Our public PGP key is available from
prefer to use DES, please call the CERT hotline for more
and other security information are available from
our web site
to the CERT mailing list for advisories and bulletins,
send email to firstname.lastname@example.org. Please include in the body of your
and "CERT Coordination Center" are registered in the U.S.
Patent and Trademark Office.
Any material furnished by Carnegie Mellon University and the Software
Engineering Institute is furnished on an "as is" basis. Carnegie
Mellon University makes no warranties of any kind, either expressed
implied as to any matter including, but not limited to, warranty of
fitness for a particular purpose or merchantability, exclusivity or
results obtained from use of the material. Carnegie Mellon University
does not make any warranty of any kind with respect to freedom from
patent, trademark, or copyright infringement.
for use, disclaimers, and sponsorship information
2002 Carnegie Mellon University.
September 14, 2002: Initial release
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
-----END PGP SIGNATURE-----