3

I'm a developer for a web site; we have a small blog powered by Movable Type that we added a few years ago. The blog doesn't get a lot of traffic or attention; we just noticed a couple of days ago that the links to the blog were broken, caused by several of the symlinks involved in our installation being missing; however most if not all of the actual files are intact. I'm fairly certain this was done maliciously, my question is whether there are any Movable Type exploits that could have been used to do this or whether my site has a larger vulnerability that was exploited. The only suspicious files I've found so far are files called "1.do" and "1.php" in one of the movable type directories; both nothing but an empty pair of single quotes. Their modification dates also correspond with the first times I found the blog pages not loading in my Apache access logs.

Anyone know what exploit may have been used and what I can do to prevent it from happening again? I have three load-balanced web servers running CentOS 5.9 and the Movable Type installation was 5.12

2

1 Answer 1

1

There are a large number of known vulnerabilities in MT 5.12, but this one that allows command injection (i.e., anything you can run at the shell, it can do) stands out: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0319

2
  • Thanks. Any idea how I can tell what commands the attacker managed to execute, like what files were left behind or what URLs were accessed?
    – joshg
    Jun 19, 2014 at 22:17
  • @joshg save text content, reformat, re-install, upgrade, lest you be by key-logger of Christmas past at midnight
    – user42209
    Aug 19, 2014 at 3:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .