Date: Sat, 4 Aug 2001 20:31:59 -0400 From: "Rob Flash" <rob@bobflash.com> To: <freebsd-questions@FreeBSD.ORG> Subject: RE: Attempted Buffer Overrun in via httpd? Message-ID: <AKEHJOKOLKBEPGPDHLMJKEFOCBAA.rob@bobflash.com> In-Reply-To: <20010804201849.A30510@acadia.ne.mediaone.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Thats just someone infected with the code red worm scanning you. I have 1000's of those in my logs, no big deal... doesn't affect apache in anyway I've seen. -Rob -----Original Message----- From: owner-freebsd-questions@FreeBSD.ORG [mailto:owner-freebsd-questions@FreeBSD.ORG]On Behalf Of Louis LeBlanc Sent: Saturday, August 04, 2001 8:19 PM To: questions@FreeBSD.ORG Subject: Re: Attempted Buffer Overrun in via httpd? I got about 100 of these sent to my webmaster account as 404 warnings before deciding to just block ports 80 and 443 for now. It's gotten to be a pain in the ass. Looks like M$ bugs us *nix enthusiasts even if we avoid them altogether :( Check out the message I've attached, it shows pretty much the same request. I'm afraid to look at all the port 80 denials I'll be showing in my logs now! Lou On 08/04/01 12:23 PM, Jon Loeliger sat at the `puter and typed: > Folks, > > I see a large number of httpd requests that look like this: > > 211.41.175.10 - - [03/Aug/2001:23:49:55 -0500] "GET /default.ida?NNNNNN > NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN > NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN > NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN > NNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3 > %u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00= > a HTTP/1.0" 400 316 "-" "-" > > in my httpd access logs. This just smells like an attemtped buffer > over run exploit at work. > > Anyone recognize it and know anything about it? Should I be worried? > I'm running a current (right out of Ports) Apache here. > > Thanks, > jdl > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message > -- Louis LeBlanc leblanc@acadia.ne.mediaone.net Fully Funded Hobbyist, KeySlapper Extrordinaire :) http://acadia.ne.mediaone.net ԿԬ management, n.: The art of getting other people to do all the work. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?AKEHJOKOLKBEPGPDHLMJKEFOCBAA.rob>