Date: Sat, 4 Aug 2001 14:27:37 -0300 (ART) From: Fernando Gleiser <fgleiser@cactus.fi.uba.ar> To: Jon Loeliger <jdl@jdl.com> Cc: <questions@FreeBSD.ORG> Subject: Re: Attempted Buffer Overrun in via httpd? Message-ID: <20010804142321.X91592-100000@cactus.fi.uba.ar> In-Reply-To: <E15T58n-000Ayh-00@jdl.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 4 Aug 2001, Jon Loeliger wrote: > Folks, > > I see a large number of httpd requests that look like this: > > 211.41.175.10 - - [03/Aug/2001:23:49:55 -0500] "GET /default.ida?NNNNNN > NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN > NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN > NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN > NNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3 > %u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00= > a HTTP/1.0" 400 316 "-" "-" > > in my httpd access logs. This just smells like an attemtped buffer > over run exploit at work. It smells like code red. It is a worm which tries to exploit a vulnerability in M$ IIS. Apache (AFAIK) is not vulnerable. The request comes from an infected machine, maybe you want to inform the webmaster about this. Fer To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010804142321.X91592-100000>