[From nobody Thu Jul 10 01:59:25 2008 Return-Path: <DSAVEXCHANGEUS001@Radware.com> X-Original-To: roman@rs-labs.com Delivered-To: roman@rs-labs.com Received: from localhost (localhost [127.0.0.1]) by mta.hosting-seguridad.com (Postfix) with ESMTP id 8F49660226 for <roman@rs-labs.com>; Thu, 26 Jan 2006 15:47:53 +0100 (CET) Received: from ARTEMIS.usa.corp.radware.com (mail19.radware.com [209.218.228.153]) by mta.hosting-seguridad.com (Postfix) with ESMTP id 876966020F for <roman@rs-labs.com>; Thu, 26 Jan 2006 15:47:52 +0100 (CET) X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----_=_NextPart_001_01C62288.0EC97C20" Subject: ALERT - Virus Perl/Exploit-TWiki found; an attachment/message has been quarantined Date: Thu, 26 Jan 2006 09:51:58 -0500 Message-ID: <FB8FD1EFD99AD411A71C00508BF7E1C1025433F4@exchangeus.usa.corp.radware.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: <FB8FD1EFD99AD411A71C00508BF7E1C1025433F4@exchangeus.usa.corp.radware.com> Thread-Topic: ALERT - Virus Perl/Exploit-TWiki found; an attachment/message has been quarantined Thread-Index: AcYiiA7Odbh7VTmHSVOf3l5Z4Pd4+g== From: "DSAVEXCHANGEUS001\(Network Associates Anti-Virus - Mailbox Agent\)" <DSAVEXCHANGEUS001@Radware.com> To: "Roman Medina-Heigl Hernandez" <roman@rs-labs.com> X-Virus-Scanned: Hosting-Seguridad This is a multi-part message in MIME format. ------_=_NextPart_001_01C62288.0EC97C20 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Action Taken: An attempt to disinfect the attachment was unsuccessful, so the attachment was quarantined from the message and replaced with a text file informing the recipient of the action taken. The infected = attachment has been placed in the designated quarantine folder. Please exercise extreme caution when handling the quarantined attachment To: bugtraq@securityfocus.com From: Roman Medina-Heigl Hernandez Sent: -268036956,29675210 Subject: TWiki exploit (search.pm / CAN-2004-1037) Attachment Details:- Attachment Name: tweaky.pl File: tweaky.pl Infected? Yes Repaired? No Virus Name: Perl/Exploit-TWiki =09 ------_=_NextPart_001_01C62288.0EC97C20 Content-Type: application/ms-tnef; name="winmail.dat" Content-Transfer-Encoding: base64 eJ8+IjoOAQaQCAAEAAAAAAABAAEAAQeQBgAIAAAA5AQAAAAAAADoAAEIgAcAFgAAAElQTS5BbnRp LVZpcnVzLlJlcG9ydACQBwENgAQAAgAAAAIAAgABBIABAFMAAABBTEVSVCAtIFZpcnVzIFBlcmwv RXhwbG9pdC1UV2lraSBmb3VuZDsgYW4gYXR0YWNobWVudC9tZXNzYWdlIGhhcyBiZWVuIHF1YXJh bnRpbmVkAG8dAQWAAwAOAAAA1gcBABoACQAzADoABAByAQEggAMADgAAANYHAQAaAAkALQA5AAQA awEBCYABACEAAAA4MjM2MjUyMjgyQTZFQjRBODk3NkVGRDEzOEQ3RkM2MgAwBwEDkAYA7AcAACQA AAADACYAAAAAAAMANgAAAAAAQAA5ACB8yQ6IIsYBHgA9AAEAAAABAAAAAAAAAAIBRwABAAAAOAAA AGM9VVM7YT0gO3A9Uk5EIE5ldHdvcmtzO2w9RVhDSEFOR0VVUy0wNjAxMjYxNDUxNThaLTE4NDAA HgBwAAEAAABTAAAAQUxFUlQgLSBWaXJ1cyBQZXJsL0V4cGxvaXQtVFdpa2kgZm91bmQ7IGFuIGF0 dGFjaG1lbnQvbWVzc2FnZSBoYXMgYmVlbiBxdWFyYW50aW5lZAAAAgFxAAEAAAAWAAAAAcYiiA7O dbh7VTmHSVOf3l5Z4Pd4+gAAHgAaDAEAAABBAAAARFNBVkVYQ0hBTkdFVVMwMDEoTmV0d29yayBB c3NvY2lhdGVzIEFudGktVmlydXMgLSBNYWlsYm94IEFnZW50KQAAAAAeAB0OAQAAAFMAAABBTEVS VCAtIFZpcnVzIFBlcmwvRXhwbG9pdC1UV2lraSBmb3VuZDsgYW4gYXR0YWNobWVudC9tZXNzYWdl IGhhcyBiZWVuIHF1YXJhbnRpbmVkAAACAQkQAQAAAFoCAABWAgAAzgMAAExaRnXZgKuNhwAKAQ0D Q3RleHQB9/8CpAPkBesCgwBQAvMGtAKDJjIDxQIAY2gKwHNl2HQwIAcTAoB9CoAIz38J2QKACoQL NxLCAdAT4GOEdGkCICBUYWsJ8FY6CqMKgEEDoGECQGXCbQUxdG8gZAQAC4BmZgWQGaFoZRkyANBo oweAAjAgd2EEIHUAgAh1Y2MHkHNmdWw6LBilcxnQGp8EIHF11wrAAHAX8G4JgCADUh0j0QeBc2Fn HVFuHwAVQL8LURwQHwAD8B0wGKVhGbC/DwEfEAMQHVAaIQWwbQuAdmcdIxVAYwUgCJAbUW/eZh0k F+QBkBhhLhgwHUG/GiQe8RrYGKUTcAQgYgnhPiAglQuAHSMBAACQZ26/GUAe8R5oHxAG8ASBLhil /lAiQBuQHVAPAASQI3ArE4Z0FUAHgCBjYXUX8953HUADoBNwIEBsItYeahMmHxilVG8YlmJ1Z1Er 8GFxQBOgYwhxdKZ5AhAxcHMuBaBtL1x+RgNhGJYIAwXQCYALgGH4LUhlKMADIDTQBKAgMTxlei9c BmACMBiWLTIANjgwMzY5NTYALDI5Njc1MjFjAUA13HViahpRGJZUsFdpa2krMQtQbyEQnCAoE6AK wBNgLnAfUCAvIENBTjdgMDBENC04cDM3KS9cQQ0a6EQTsAtwbHM6LVM8/xsGTmEHgDoZsHf5KvBr eTuwFSAy5SIxQO/ECkkllT8gWQeQM5ZPIIALcBVBQ+BObxilVhdE4DIAQJVQBJBsL0U9OtQtOmMv XEgtAZEgfQFJ0AAAHgA1EAEAAABLAAAAPEZCOEZEMUVGRDk5QUQ0MTFBNzFDMDA1MDhCRjdFMUMx MDI1NDMzRjRAZXhjaGFuZ2V1cy51c2EuY29ycC5yYWR3YXJlLmNvbT4AAAsA8hABAAAAHwDzEAEA AACyAAAAQQBMAEUAUgBUACAALQAgAFYAaQByAHUAcwAgAFAAZQByAGwA//hFAHgAcABsAG8AaQB0 AC0AVABXAGkAawBpACAAZgBvAHUAbgBkACUAMwBCACAAYQBuACAAYQB0AHQAYQBjAGgAbQBlAG4A dAD/+G0AZQBzAHMAYQBnAGUAIABoAGEAcwAgAGIAZQBlAG4AIABxAHUAYQByAGEAbgB0AGkAbgBl AGQALgBFAE0ATAAAAAAACwD2EAAAAABAAAcwcPOsDogixgFAAAgw6kCpN4cixgEDAPE/CQQAAB4A +D8BAAAAQQAAAERTQVZFWENIQU5HRVVTMDAxKE5ldHdvcmsgQXNzb2NpYXRlcyBBbnRpLVZpcnVz IC0gTWFpbGJveCBBZ2VudCkAAAAAAgH5PwEAAABkAAAAAAAAANynQMjAQhAatLkIACsv4YIBAAAA AAAAAC9PPVJORCBORVRXT1JLUy9PVT1SQURXQVJFVVMvQ049TkVUV09SSyBBU1NPQ0lBVEVTL0NO PURTQVZFWENIQU5HRVVTMDAxAB4A+j8BAAAAFQAAAFN5c3RlbSBBZG1pbmlzdHJhdG9yAAAAAAIB +z8BAAAAHgAAAAAAAADcp0DIwEIQGrS5CAArL+GCAQAAAAAAAAAuAAAAAwD9P+QEAAADABlAAAAA AAMAGkAAAAAAHgAwQAEAAAASAAAARFNBVkVYQ0hBTkdFVVMwMDEAAAAeADFAAQAAABIAAABEU0FW RVhDSEFOR0VVUzAwMQAAAB4AOEABAAAAEgAAAERTQVZFWENIQU5HRVVTMDAxAAAAHgA5QAEAAAAC AAAALgAAAAsAKQAAAAAACwAjAAAAAAADAAYQ/B82KQMABxAOAgAAAwAQEAAAAAADABEQAAAAAB4A CBABAAAAZQAAAEFDVElPTlRBS0VOOkFOQVRURU1QVFRPRElTSU5GRUNUVEhFQVRUQUNITUVOVFdB U1VOU1VDQ0VTU0ZVTCxTT1RIRUFUVEFDSE1FTlRXQVNRVUFSQU5USU5FREZST01USEVNRVMAAAAA AgF/AAEAAABLAAAAPEZCOEZEMUVGRDk5QUQ0MTFBNzFDMDA1MDhCRjdFMUMxMDI1NDMzRjRAZXhj aGFuZ2V1cy51c2EuY29ycC5yYWR3YXJlLmNvbT4AAAwB ------_=_NextPart_001_01C62288.0EC97C20-- ]