iframe hack FedoraCore2 problem?

[maccas]

Hi one of my VPS accounts got hacked and they installed a iframe on all sites and even on control panel, they ran a perl script through SSH. My hosts says it is a FedoraCore2 vulnerability and they told me to backup and they will upgrade to CentOS4, is this true, anyone else heard of this?

[encyclo]

Fedora Core 2 is no longer supported, and hasn't been supported for quite a while, so there may be any number of vulnerabilites which caused the problem.

As for the switch to Centos, it sounds like a very sensible idea. You will still need to ensure the server gets regular updates, but this will be much easier with Centos than Fedora.

[lammert]

...they ran a perl script through SSH. My hosts says it is a FedoraCore2 vulnerability...

The last significant problems in sshd that I know of were buffer management issues in the OpenSSH protocol suite in 2003 (CERT Advisory CA-2003-24). The support for FC2 stopped way after that date, so your installation (if properly updated in the past) shouldn't have been suceptible for that.

Are you sure that running a perl script through SSH to your server was really the cause of the IFRAME hack and that upgrading to another OS closes this hole or was the attack coming via another door (PHP etc)?