From owner-freebsd-security  Sat Jul 21 14:18:27 2001
Delivered-To: freebsd-security@freebsd.org
Received: from pogo.caustic.org (pogo.caustic.org [208.44.193.69])
	by hub.freebsd.org (Postfix) with ESMTP id 39D2C37B406
	for <freebsd-security@FreeBSD.ORG>; Sat, 21 Jul 2001 14:18:25 -0700 (PDT)
	(envelope-from jan@caustic.org)
Received: from localhost (jan@localhost)
	by pogo.caustic.org (8.11.0/ignatz) with ESMTP id f6LLIO044724;
	Sat, 21 Jul 2001 14:18:24 -0700 (PDT)
Date: Sat, 21 Jul 2001 14:18:24 -0700 (PDT)
From: "f.johan.beisser" <jan@caustic.org>
To: nathan@salvation.unixgeeks.com
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: possible?
In-Reply-To: <20010721204942.12010.qmail@salvation.unixgeeks.com>
Message-ID: <Pine.BSF.4.21.0107211416450.5567-100000@pogo.caustic.org>
X-Ignore: This statement isn't supposed to be read by you
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On 21 Jul 2001 nathan@salvation.unixgeeks.com wrote:

> 
>  okay, today i checked my apache logs this is what i got:
> 
> 195.10.116.2 - - [19/Jul/2001:15:50:20 -0700] "GET /default.ida?NNNNNNNNNNNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u
> 6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u53
> 1b%u53ff%u0078%u0000%u00=a  HTTP/1.0" 400 332
> 
> this same exact get request came from several different address as well. such
> as: 128.138.105.172, 202.157.154.126, and a couple of others. any ideas? any
> remote exploits in apache i've missed? i'm running Apache/1.3.19 Server..

that right there is the "Code Red" exploit for IIS.

the worm has been making the rounds for the last couple weeks, and is not
an exploit against apache.

you're pretty much safe.

-- jan

-------/ f. johan beisser /--------------------------------------+
  http://caustic.org/~jan                      jan@caustic.org
   "if my thought-dreams could be seen..
       "they'd probably put my head in a gillotine"
	     -- Bob Dylan


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message