Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Next challenges

Recent achievements

  • Global
  • Personal

Recognition

  • Give kudos
  • Received
  • Given

Leaderboard

  • Global

Trophy case

Kudos (beta program)

Kudos logo

You've been invited into the Kudos (beta program) private group. Chat with others in the program, or give feedback to Atlassian.

View group

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

xmrig tried to install some packets from bamboo home

Hello,

I use bamboo v 5.15.0.1.

I received from my bamboo instance the next email with:
subject: *** SECURITY information for dc16-01 ***
body: 

dc16-01 : Sep  5 11:19:42 : bamboo : user NOT in sudoers ; TTY=pts/9 ; PWD=/home/bamboo/xmrig-3.1.1/manual ; USER=root ; COMMAND=apt-get install git build-essential cmake libuv1-dev libmicrohttpd-dev libssl-dev libhwloc-dev

When I check home dir I found this:

drwxr-xr-x 3 bamboo bamboo 67 Sep 5 11:19 xmrig-3.1.1
-rw-r--r-- 1 bamboo bamboo 3.6M Aug 31 04:15 xmrig-3.1.1-xenial-x64.tar.gz

I do not download xmrig and user bamboo is not allowed to login over ssh for do something like this. I think that may happened only over web part of bamboo. Maybe it's some security bug of bamboo... and it can download and try to install this package.

If you need additional information please ask me.

Best regards, Volodymyr

2 answers

1 accepted

0 votes
Answer accepted

Hi @volodymyr_kondratiuk ,

Bamboo v5.15 was released back in February/2017. Since then Atlassian released a few Security Advisory. Perhaps, Bamboo Security Advisory 2017-03-10, relates to the issue you have reported.

You should consider backing up and upgrading Bamboo to a most recent version.

Kind regards,
Rafael

0 votes
Steven Behnke Community Leader Sep 06, 2019

I believe you should raise this over https://support.atlassian.com/contact/

"Atlassian no longer offers personal support for Starter Licenses."
I can't because I have starter licence :)

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Bamboo

Bamboo 7.1 is here and is packed with value!

I'm happy to announce that Bamboo 7.1 has been released and it’s overflowing with awesome new features. Top-voted issues First and foremost, a bunch of JAC top voted issues has been delivered - y...

703 views 1 6
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you