[tlug] Who is www-data, and why do they want my CPU?

[Dave M G <dave@example.com>]

TLUG,

A while back I reported that I was seeing 100% CPU use every now and 
again at random times:
http://www.tlug.jp/ML/0705/msg00373.html

Since then, I've been able to determine that the offending process is 
called "www-data". I haven't, however, been able to determine anything 
about the timing of when this will happen next or why. All I can say is 
that is happens maybe once or twice a week.

I can kill it whenever I see it by getting it's process id in "top" and 
then running "kill -9". But it comes back every so often, and I'd rather 
have a solution that addresses the source of the problem.

I don't have any cron jobs, at least none that I can see.

I found this web site which seems sort of related:
http://ubuntuforums.org/showthread.php?t=133178

Where it cryptically suggests the problem is a "mambo exploit". I don't 
think I use Mambo, which seems to be a CMS, for anything.

Any ideas what www-data is doing and how I can stop it?

--
Dave M G
http://www.tlug.jp/wiki/User:Dave_M_G