Santy, il verme dei forum!

La notizia si legge da ieri su tanti siti, tengo a citarne due, che sono le mie fonti di questa mattina: Search Engine Watch Blog, Netcraft e Slashdot.

La notizia che questa mattina popola maggiormente le mie fonti di informazione e' quella relativa al worm Santy, che sfrutta un baco nel file viewtopic.php di quello che forse e' il programma di gestione forum piu' famoso al mondo: phpBB.

In ordine (di lettura da parte mia), ho letto:
Da Search Engine Blog Watch:

News.com reports that a web worm named Santy is utilizing Google to help it spread to web bulletin boards using the PHP scripting language. The worm sends Google a specific search request, essentially asking for a list of vulnerable sites....

Da Netcraft:

Thousands of servers hosting phpBB forums have been defaced today by a worm that exploits a security hole in the popular bulletin board program.

E infine da Slashdot:

troop23 writes "A web worm that identifies potential victims by searching Google is spreading among online bulletin boards using a vulnerable version of the program phpBB, security professionals said on Tuesday. Almost 40,000 sites may have already been infected. In an odd twist if you use Microsoft's Search engine to scan for the phrase 'NeverEverNoSanity'--part of the defacement text that the Santy worm uses to replace files on infected Web sites--returns nearly 39,000 hits." Reader pmf sent in a few more information links: F-Secure weblog and Bugtraq posting. Update: 12/22 03:34 GMT by T: ZephyrXero writes to this news.com article that says Google is now squashing requests generated by the worm.

Tra parentesi, dato che la patch e' fuori da un bel po', che ne direste (chi non l'ha ancora fatto) di aggiornare il programmillo? :mrgreen:

Originally posted by richm from Netcraft