Date: Thu, 09 Aug 2001 06:25:25 -0500 From: Robin Smith <rasmith@aristotle.tamu.edu> To: freebsd-security@FreeBSD.ORG Cc: "Nickolay A.Kritsky" <nkritsky@internethelp.ru> Subject: Re: Re[2]: should I concerned? Message-ID: <200108091125.GAA29210@aristotle.tamu.edu> In-Reply-To: Message from Claude Buisson <ubc@paris.framatome.fr> of "Thu, 09 Aug 2001 12:35:21 %2B0200." <20010809123052.U4026-100000@eve.framatome.fr>
next in thread | previous in thread | raw e-mail | index | archive | help
>>>>> "Claude" == Claude Buisson <ubc@paris.framatome.fr> writes:
Claude> I have seen a few of these starting from August 6, amidst
Claude> a flow of "standard" GET /default.ida?NNNNNNNN... and GET
Claude> /default.ida?XXXXXXX... Is Code Red II bugged ?
My httpd access log is full of "GET /default/ida?XXX....", which is
evidently the Code Red II signature; haven't seen very many Code Red I
hits in the last few days (but Code Red II seems to hit us with much
greaterfrequency).
The "NNN.." and "XXX..." strings are just filler to overflow a buffer;
the payload (and the real signature of the worm) is the bit of code at
the end, which is object code encoded in hex ("%u" and four digits).
Compare these and you'll see they are the same. But it's so much easier
to type "grep NNNN /var/log/..." :=)
Robin Smith
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200108091125.GAA29210>