RE: [cobalt-security] RAQ3 & RAQ4 Hacked...

["Ben Koshy" <ben@xxxxxxxxxxx>]

Title: Message

Update: Turns out we isolated it to a newly activated NFS Daemon on that box.  Anyone know of vunrenbilities on the NFS Daemon there?  Are there patches or security that can be applied?

-----Original Message-----
From: cobalt-security-admin@xxxxxxxxxxxxxxx [mailto:cobalt-security-admin@xxxxxxxxxxxxxxx] On Behalf Of Ben Koshy
Sent: March 31, 2002 1:43 PM
To: cobalt-security@xxxxxxxxxxxxxxx
Subject: [cobalt-security] RAQ3 & RAQ4 Hacked...

I had this group called "Acid Fallz" hack 2 of my servers over the last few months...they are based out of Russian and claim to only do defacements to prove security vunrenbilities... anyway, both servers had all patches applied from Cobalt.  All that was done was the index.htm page was replaced with the hacked version and the old page moved to a backup file.  A couple months back they did this to one of our RAQ4s, and then yesterday to a RAQ3.

 

Any idea what hack this could be? I'm at a loss...