Linux/Lupper is a worm. The worm will infect Linux systems and spreads through web servers by exploiting AWStats Rawlog Plugin Input Vulnerability and XML-RPC for PHP Remote Code Execution Exploit. This worm will not infect windows system.

This worm sends random http requests on port 80. If any web server having the above-mentioned vulnerabilities is located, it will exploit the vulnerabilities and downloads a copy of itself into the web server.

This worm sends some pre-configured list of commands to the awstats scripts present in the following locations of the web server to exploit AWStats Rawlog Plugin Input Vulnerability.

/stats/awstats.pl
/cgi-bin/awstats.pl
/cgi-bin/awstats/awstats.pl
/awstats/awstats.pl
/scripts/awstats.pl
/cgi/awstats/awstats.pl
/cgi-bin/stats/awstats.pl

It also sends the some pre-configured list of commands to the scripts present in the following locations of the web server to exploit XML-RPC for PHP Remote Code Execution Exploit.

/xmlrpc.php
/blog/xmlrpc.php
/xmlrpc/xmlrpc.php
/xmlsrv/xmlrpc.php
/drupal/xmlrpc.php
/blogs/xmlrpc.php
/community/xmlrpc.php
/blog/xmlsrv/xmlrpc.php
/blogtest/xmlsrv/xmlrpc.php
/blogs/xmlsrv/xmlrpc.php
/b2evo/xmlsrv/xmlrpc.php
/wordpress/xmlrpc.php
/b2/xmlsrv/xmlrpc.php
/phpgroupware/xmlrpc.php

This worm first appeared on November 6, 2005.

 Other names of Linux/Lupper Worm:

This Worm is also known as Linux/Lupper.A, Linux/Lupper.A, Linux/Lupper.worm .