[prev in list] [next in list] [prev in thread] [next in thread] 

List:       suse-security
Subject:    apache gone crazy ?
From:       Francisco Costa <fgcosta () ccj ! ufsc ! br>
Date:       2001-12-26 16:50:27
[Download RAW message or body]

	I have no idea what happened, could this be some sort of exploit ?
Memory problem ? HD bad blocks ?
	This produced about 15000 lines of log entries (started day 24 and
ended when someone rebooted the machine about 30 minutes ago).
	Should I be worried ?

	I'm running SuSE 7.3 pro, apache is 1.3.20 and php 4.0.6

Here's the log entry:

Code: 8b 44 81 18 89 41 14 03 59 0c 83 f8 ff 75 23 8b 41 04 8b 11
<1>Unable to handle kernel paging request at virtual address c82eb62c printing eip:
c012ab11
*pde = 00000000
Oops: 0000
CPU:    0
EIP:    0010:[kmem_cache_alloc+113/204]
EFLAGS: 00010803
eax: 00b9016d   ebx: 7202da00   ecx: c54ab060   edx: c4df0ae0
esi: c11fd1a0   edi: 00000246   ebp: 000001f0   esp: c59a3ed0
ds: 0018   es: 0018   ss: 0018
Process httpd (pid: 30662, stackpage=c59a3000)
Stack: 00000004 c3c75850 00000000 bffffafc c0146435 c11fd1a0 000001f0 00000004
       c01ed32a 00000004 c01edead 00000004 08094bd0 00000000 bffffb1c 401d54a0
       ffffffe8 c59a2000 00000004 c011342c bffffb1c c2899f00 c2899180 c06b0ac0
Call Trace: [get_empty_inode+17/136] [sock_alloc+6/176]
        [sys_accept+61/252] [do_page_fault+0/1412] [unmap_fixup+274/300]
[unmap_fixup+283/300] [do_brk+285/512] [sys_rt_sigaction+159/272]
        [sys_socketcall+180/512] [error_code+52/64] [system_call+51/64]


Thanks in advance for your time ! :)

Francisco Costa



[prev in list] [next in list] [prev in thread] [next in thread]