jboss jmx-console漏洞导致黑客攻击(已解决)

情况为登录服务器发现jboss安装目录的/bin下有异常代码,查看当前运行进程发现下图所示

 

190xx 196xx 0 09:27 ?

00:00:00 sh -c ./pnscan -r JBoss -w "HEAD / HTTP/1.0\r\n\r\n" -t 6400 16x.22x.0.0/16 80 > /tmp/sess_0088025413980486928597bff226164

190xx 190xx 1 09:27 ?

00:00:02 ./pnscan -r JBoss -w HEAD / HTTP/1.0\r\n\r\n -t 6400 16x.22x.0.0/16 80

 随即进行了google找到jboss的一个漏洞:https://access.redhat.com/knowledge/solutions/30744

按上述方案解决就可.

 

详细情况见该文:https://community.jboss.org/message/632603?tstart=0

解决方案见该文:https://access.redhat.com/knowledge/solutions/30744

jboss console配置中文版见该文:http://www.blogjava.net/paulwong/archive/2012/02/13/369841.html