1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice

plesk kernel: application bug: perl

Discussion in 'Plesk for Linux - 8.x and Older' started by PixyPumpkin, May 29, 2005.

  1. PixyPumpkin

    PixyPumpkin Guest

    0
     
    Hi, last night i received an error from Plesk:

    May 29 01:48:04 plesk kernel: application bug: perl(2669) has SIGCHLD set to SIG_IGN but calls wait().
    May 29 01:48:04 plesk kernel: (see the NOTES section of 'man 2 wait'). Workaround activated.
    May 29 02:00:25 plesk kernel: application bug: perl(2669) has SIGCHLD set to SIG_IGN but calls wait().

    This error generated 50GB of traffic within a couple of hours.
    Does anybody know how to solve this problem?

    After a reboor all seemed fine, but will it come back?

    Thx!
     
  2. Griffith

    Griffith Guest

    0
     
    There can be more than one thing that causes this, but last time I got it, it was a hacker who were running a perl wget program... it ran as perl, but said "/usr/bin/httpd -DSSL" when I used ps -aux, and you could also see it while running "netsat -nlp"

    Check /tmp if there is suspicous files...
     
  3. PixyPumpkin

    PixyPumpkin Guest

    0
     
    Wow, this is exactly what happened, the file wget.pl was indead in the /tmp Thx! :)
     
  4. Griffith

    Griffith Guest

    0
     
    But, you should do something with it.. if you search every httpd error_log after admin_styles.php I think it was.. you will probably find wich site this hack came from.. will guess it is a phpBB exploit..

    grep -lir "admin_styles.php" /path/to/sites/httpd_logs/error_log


    Another thing... you said it genreated 50GB transfer... do you have any clue what it was getting and where it was stored?
     
  5. PixyPumpkin

    PixyPumpkin Guest

    0
     
    I had only one phpBB running, I deleted it.
     
  6. PixyPumpkin

    PixyPumpkin Guest

    0
     
    Not a cleu, the disk space did not change?
     
Loading...