X-Original-To: pgsql-www-postgresql.org@localhost.postgresql.org Received: from localhost (av.hub.org [200.46.204.144]) by svr1.postgresql.org (Postfix) with ESMTP id 1C974DA510 for ; Mon, 21 Nov 2005 16:23:23 -0400 (AST) Received: from svr1.postgresql.org ([200.46.204.71]) by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024) with ESMTP id 50514-03-2 for ; Mon, 21 Nov 2005 20:23:23 +0000 (GMT) X-Greylist: from auto-whitelisted by SQLgrey- Received: from mx-2.sollentuna.net (mx-2.sollentuna.net [195.84.163.199]) by svr1.postgresql.org (Postfix) with ESMTP id 7F6BCDA4B6 for ; Mon, 21 Nov 2005 16:23:20 -0400 (AST) Received: from ALGOL.sollentuna.se (janus.sollentuna.se [62.65.68.67]) by mx-2.sollentuna.net (Postfix) with ESMTP id CDCEA8F286 for ; Mon, 21 Nov 2005 21:23:21 +0100 (CET) Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Subject: svr2 cleanup Date: Mon, 21 Nov 2005 21:23:27 +0100 Message-ID: <6BCB9D8A16AC4241919521715F4D8BCE92E88B@algol.sollentuna.se> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: svr2 cleanup thread-index: AcXu2W57EmDL/93LTZqQaq0TIp3qAA== From: "Magnus Hagander" To: X-Virus-Scanned: by amavisd-new at hub.org X-Spam-Status: No, score=0.002 required=5 tests=[AWL=0.002] X-Spam-Score: 0.002 X-Spam-Level: X-Archive-Number: 200511/130 X-Sequence-Number: 8845 In the process of trying to figure out what happened to svr2, I have disabled a whole lot of virtual servers, just to make sure we don' thavr vulnerable code running. That's david.beta, alexey.beta, wwwdevel and wwwtest. If any of those was actually in use, let me know and I'll turn them back on. I've also removed "twiki" because the version installed had a bug that could be used to create just the kind of scenario we had. It's my primjary guess on how the stuff got on the server and got executed. I'm unsure wether this was actually used somewhere. //Magnus