[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Apache listening on 43133 and 43142-43144



Hi,

this morning the tiger on one of my servers reported that apache is
listening on some new ports:

# Checking listening processes                                                                                                                                           
NEW: --WARN-- [lin003w] The process `apache' is listening on socket 43133 (TCP on every interface) is run by root. 
NEW: --WARN-- [lin003w] The process `apache' is listening on socket 43142 (TCP on every interface) is run by root.
NEW: --WARN-- [lin003w] The process `apache' is listening on socket 43143 (TCP on every interface) is run by root.
NEW: --WARN-- [lin003w] The process `apache' is listening on socket 43144 (TCP on every interface) is run by root.

After restarting apache it was gone. What could that be? I'm a bit
confused since these ports were never mentioned in the config-files...


The other thing I discovered this morning is that shortly after
restarting apache it spawns around 70 times and one instance is defunct,
together with one defunct instance of php3 (which I run here as cgi).


Is there a new apache-exploit in the wild?

- Alexander

Attachment: pgpo9rF4b5hX5.pgp
Description: PGP signature


Reply to: