# MA-044.072002: MyCERT Advisory - Apache Worm

**Date:** 03 Jul 2002  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-044.072002  
**Advisory ID:** MA-044.072002

---

1.0 Description
#### 1.1 Overview
The Apache worm was first detected on June 28th 2002, Eastern Standard Time (EST). The worm exploits a 2 week-old chunk handling vulnerability (http://www.cert.org/advisories/CA-2002-17.html) on unpatched Apache servers to spread itself. Though the worm is actively scanning the networks, many Security Experts rank it currently as low risk.
#### 1.2 Aliases
ELF\_SCALPER.A
BSD/Scalper.worm
Unix/Scalper.A
#### 1.3 Systems Affected
Apache web servers version 1.2.2 and above, 1.3 through 1.3.24, and versions 2.0 through 2.0.36. running on FreeBSD operating system.
#### 1.4 Limitation
The worm infects Apache web servers running on FreeBSD operating system only.
#### 1.5 Variants
Scalper.A
#### 1.6 Payload
1.6.1 Performs TCP, UDP, DNS, and E-mail flooding.
1.6.2 Creates a flood net - a collection of compromised servers that can be used as a DDOS agent in DOS attack
1.6.3 Large scale e-mailing: Contains the functionality to send e-mail spam to all e-mail addresses found on the infected machines
1.6.4 Degrades performance as a result of active port 80 requests
1.6.5 Releases confidential info: allows unauthorized access to the infected machine
1.6.6 Compromises security settings: allows unauthorized access to the infect machine
### 2.0 Technical Matters
"The worm will attempt to locate vulnerable computers on a set of IP class ranges that is hard-coded in the worm. An example of an IP class range would be 55.xxx.xxx.xxx. The only hard coded value is the first element in the IP, the second element is randomly generated, and the third and fourth elements are scanned incrementally." - (Symantec)
"It sends a port 80 HTTP GET request to all IP addresses and when it finds an Apache server, it attempts to use the Apache HTTP Server chunk encoding overflow vulnerability to execute a remote shell command and simulate a handshake between the infected computer and the vulnerable computer." - (Symantec)
"The worm sends itself in UUEncoded form to the remote computer as the file /tmp/.uua. It then decodes and executes /tmp/.a after setting /tmp/.a to executable. The worm also kills all previously installed copies of the worm on the vulnerable computer." - (Symantec)
"Upon execution the worm sets up a backdoor to UDP port 2001 and starts scanning predefined set of Class – A networks and will infect any vulnerable Apache web servers that the worm finds." - (F-Secure)
The backdoor component of the worm allows a remote control of the worm and the following remote instruction functions:
- Collect email addresses from the infected computer
- View Web pages
- Send email messages (spam)
- TCP, UDP, DNS Flooding
- Execution of shell commands
- Other Denial of Service and DDOS and DDOS agent functions against arbitrary hosts.
*Note: The execution of programs happens with the same user privilege as the Apache server.*
#### 2.1 System Footprint
The scanning activity of the Apache worm produces the following log entries for any web server listing on port 80/tcp:
POST / HTTP/1.1
Host: Unknown
X-CCCCCCC:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAA
ÊÿD$ €|$ ué1À‰D$ ÆD$
> > ‰d$ ‰D$‰D$ ‰D$ ‰T$ ‹T$ ‰ $1À°]Í€1ÉÑ,$s'1ÀPPPPÿ $Tÿ $ÿ $ÿ $ÿ $QP° Í€XXXXX> > uÎë½?1ÀPQP1À°ZÍ€ÿD$ €|$ uï1ÀPÆ $€4$ hBLE\*h\*GOB‰ã°
> > PS° PP° Í€1ÀPhn/shh//bi‰ãPS‰áPQSP°;Í€Ì
### 3.0 Possible Steps
#### 3.1 Prevention
There are a few steps that System Administrators can take to prevent and defend against the infection. These measures apply to web servers.
3.1.1 Scan your server if it is vulnerable to the Apache Web Server Chunk Handling.
Apache Chunked Scanner from eEye Digital Security
http://www.eeye.com/html/Research/Tools/apachechunked.html
3.1.2 Upgrade to the latest version
The Apache Software Foundation has released two new versions of Apache that correct this vulnerability. System administrators can prevent the vulnerability from being exploited by upgrading to Apache httpd version 1.3.26 or 2.0.39 which is available at:
http://www.apache.org/dist/httpd/
3.1.3 Blowchunks - Protecting Existing Apache Servers until Upgrades Arrive
While waiting for proper fixes, upgrades and patches, you still can protect your vulnerable Apache server. There are two versions of code to allow the server to intercept each incoming HTTP request (at the 'Post Read Request' phase), and deny and log any chunked encoding requests. Consequently, preventing clients being able to trigger the vulnerable'chunk size' reading code, and prevent DoS or exploits.
The tool code is available at:
http://www.securiteam.com/tools/5WP0M0U7FS.html
3.1.4 Apply a patch from your vendor
If your vendor has provided a patch to correct this vulnerability, you may want to apply that patch rather than upgrading your version of httpd.
3.1.5 Turn off and remove unneeded services.
By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
#### 3.2 Detection
No specific tool has been developed yet to detect the presence of the worm. However, the above payloads mentioned in 1.6 could be used as a means of detection. Close monitoring and checking should be made if any such payloads occur to your machine besides checking for the presence of the files "/tmp/.a”, “/tmp/.uua" in your machine.
#### 3.3 Removal
The worm can be removed from an infected system by deleting file "/tmp/.a"," /tmp/.uua" and terminating the worm process with command "killall -9 .a". However, deleting of the "/tmp/.a", "/tmp/.uua" files and terminating the worm processes may not clean the affected system from any hidden backdoors. Thus, it is recommended to reinstall the system.
### 4.0 More Information
More information on this worm can be obtained from the following sites:
4.1 **Symantec:**
http://securityresponse.symantec.com/avcenter/venc/data/freebsd.scalper.worm.html
4.2 **CERT Advisory:**
http://www.cert.org/advisories/CA-2002-17.html
4.3 **F-Secure:**
http://www.europe.f-secure.com/v-descs/scalper.shtml
4.4 **McAfee:**
http://vil.nai.com/vil/content/v\_99539.htm
4.5 **Securiteam Mailing List**
http://www.securiteam.com/mailinglist.html