Antwort: Re: [suse-security] Web server attacks

Here is cut from my error_log: [Mon Aug 6 11:28:38 2001] [error] [client 61.129.67.225] File does not exist: /usr/local/apache/htdocs/default.ida [Mon Aug 6 11:33:11 2001] [error] [client 194.247.87.239] Client sent malformed Host header

and so on repeating lines 1 and 2, but 2nd more often.

Please let me know where I can read more about this worm.

There is more info about the code red worm available at: http://www.eeye.com/html/Research/Advisories/AL20010717.html including a full analysis and disassembled code (link on the page). HTH Chr. Burri .-. /v\ L I N U X // \\ >I know Kung Fu!< /( )\ ^^-^^ Sven Michels radat.com> Kopie: suse-security@suse.de Thema: Re: [suse-security] Web server attacks 07.08.2001 16:17 Dmitriy Melihov wrote: thats code red, we've about 5000-8000 hosts a day trying to 'exploit' a webserver in our class c ... f*cking iis... Sven -- intraDAT AG http://www.intradat.com Wilhelm-Leuschner-Strasse 7 Tel: +49 69-25629-0 D - 60329 Frankfurt am Main Fax: +49 69-25629-256 -- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com