Red Hat Bugzilla – Bug 169615
security hole in kernel/apache
Last modified: 2007-04-18 13:32:19 EDT
From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Description of problem:
I run 7.3 rh with all updates form fedora legacy and my system was hacked with uselib24 exploit :/ I found 10 processes runing uselib24 with user apache.
So, it is kernel and apache hacked.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
use rh7.3 :(
Expected Results: this should be fixed.
Sorry it has taken awhile to respond to your bug report.
It may very well be that the processes you see running a program called
"uselib24" under user apache are caused by an exploit to buggy PHP or Perl
scripts on your website. For example, see the following URL, that shows
how a server had programs called "uselib24" running as user apache, due to
PHPBB2 exploits and/or buggy perl scripts:
In the example at artoo.net, the fact that those programs are running has
less to do with the kernel, and more to do with the buggy scripts which are
allowing external people to download and run programs as user apache. I
suspect you have been bitten by buggy PHP or PERL scripts like artoo.net was.
I'd look in your webserver logs for tell-tale examples like artoo.net.
You apparently are running version 2.4.20-43.7.legacy of the Linux kernel.
Neither this version, nor the prior version 2.4.20-42.7.legacy, should be
susceptible to being rooted via any uselib() exploits which affect earlier
versions of the Linux kernel. 
You should be protected from "uselib24" processes actually getting root
access, if indeed they are attempting to use a uselib() exploit. That's
the best we can do with kernel updates.
Marc, Jesse, I would recommend closing this ticket NOTABUG.
V, if you feel that this is clearly a kernel bug, you are welcome to
 Here's a URL to the advisory that fixes root privilege escalation from
uselib() exploits, CAN-2004-1235: