find a UDP threat

[wildwilla]

Hiya All

My ISP ha just contacted me to say one of our hosted VPS Plesk severs has a UDP attack emanating from it.

How best can i trouble shoot this ?

the server runs plesk "Parallels Plesk Panel version 9.5.4"

 

[jneff]

Sounds similar to what I had to deal with yesterday. There are two avenues that you need to take -- what's causing the UDP flood and how it is being caused.

I suspect you need to look for created this week that container code similar to:
eval(urldecode(@$_REQUEST['encoded_bad_stuff']

We had 3 servers that had a few hundred of these files created through an exploit in Plesk Panel on Tuesday evening. Yesterday, those files were accessed and triggered a UDP flood on our network.

Talk to parallels support about the hotfix issued last night for 9.5.4 that supposedly resolves the sql injection vulnerability in Plesk Panel.

more information on my situation in this other thread:
http://forum.parallels.com/showthread.php?t=257260