Short intro: I have a box with FreeBPX (Centos 5.4) on it. Due to an exploit a user got access to the Web UI and was able to collect trunk usernames and passwords.
My main questions is as follow, the user did not gain root access. Now for the investigation I am left with the access_log from Apache http server, so I need to know am I investigating on valid files.
My question would be, is it possible that the user altered the Apache logs without the root access. Apache created several files over time so I have
access_log.2 ... each file seems valid to me and the created dates seems to be valid.
Can I rely on those files. Is there a known vulnerability that Apache's access_log can be compromised without the root access?