A new variant of the Mare family of Linux worms has been found. This one exploits one vulnerability in Mambo and another one in PHP XML-RPC.

Mare.D installs an IRC-controlled backdoor as payload.

Our description is available at

https://www.f-secure.com/v-descs/mare_d.shtml