Linux server worm exploits known flaw
Source: CNet News
A worm spreading among Linux servers late Friday takes advantage of a flaw discovered more than a month ago in a program designed to strengthen the privacy of Internet communications.
Designated "Linux.Slapper.Worm" by security firm Symantec, the self-replicating program may have originated in Europe and threatens Linux servers that offer an encryption feature known as Secure Sockets Layer, the standard method for encrypting sensitive Web traffic, through a common extension to the open-source Apache Web server.
"At this time over 350 computers have been observed performing this activity," said Symantec in its advisory. "This includes computers located in Portugal and Romania, where initial reports of the worm originated."
The worm, which is also known as Apache/mod_ssl after the Web server module it exploits, seems to have been created to create a distributed network with which a denial-of-service attack could be launched. A denial-of-service attack attempts to shutdown a network by overloading it with data from a number of servers, as Slapper apparently is attempting, or by causing systems to crash by exploiting a flaw in the software.
