Mailinglist Archive: opensuse-security (320 mails)
| < Previous | Next > |
New(?) exploit for webservers?
- From: Sven 'Darkman' Michels <sven@xxxxxxxxxx>
- Date: Fri, 09 May 2003 04:18:04 +0200
- Message-id: <3EBB0FDC.6060000@xxxxxxxxxx>
evening,
i noticed some weird logentries in my apache access log:
57.67.127.228 - - [09/May/2003:02:23:32 +0200] "ãB" 200 6618 "-" "-"
57.67.127.228 - - [09/May/2003:02:48:19 +0200] "ãB" 200 6618 "-" "-"
57.67.127.228 - - [09/May/2003:03:18:09 +0200] "ãB" 200 6618 "-" "-"
66.74.204.40 - - [09/May/2003:03:45:11 +0200] "ãA" 200 6617 "-" "-"
66.74.204.40 - - [09/May/2003:03:46:15 +0200] "ãA" 200 6617 "-" "-"
66.74.204.40 - - [09/May/2003:03:47:17 +0200] "ãA" 200 6617 "-" "-"
217.235.22.155 - - [09/May/2003:03:58:38 +0200] "ãL" 200 6619 "-" "-"
217.235.22.155 - - [09/May/2003:03:59:23 +0200] "ãL" 200 6619 "-" "-"
200.40.225.210 - - [09/May/2003:03:59:34 +0200] "ã=" 200 6619 "-" "-"
217.235.22.155 - - [09/May/2003:04:00:08 +0200] "ãL" 200 6619 "-" "-"
217.234.189.246 - - [09/May/2003:04:00:59 +0200] "ã=" 200 6620 "-" "-"
80.144.22.228 - - [09/May/2003:04:01:28 +0200] "ãN" 200 6618 "-" "-"
217.234.189.246 - - [09/May/2003:04:01:48 +0200] "ã=" 200 6620 "-" "-"
80.144.22.228 - - [09/May/2003:04:02:12 +0200] "ãN" 200 6618 "-" "-"
217.234.189.246 - - [09/May/2003:04:02:41 +0200] "ã=" 200 6620 "-" "-"
80.144.22.228 - - [09/May/2003:04:02:57 +0200] "ãN" 200 6618 "-" "-"
since 8th may they're some of these entries, mostly a few times from
the same ip and the requests change a bit. Anybody has seen that before?
or know anything about it? I quickchecked bugtraq for something like
that but didn't found something.
Regards,
Sven
i noticed some weird logentries in my apache access log:
57.67.127.228 - - [09/May/2003:02:23:32 +0200] "ãB" 200 6618 "-" "-"
57.67.127.228 - - [09/May/2003:02:48:19 +0200] "ãB" 200 6618 "-" "-"
57.67.127.228 - - [09/May/2003:03:18:09 +0200] "ãB" 200 6618 "-" "-"
66.74.204.40 - - [09/May/2003:03:45:11 +0200] "ãA" 200 6617 "-" "-"
66.74.204.40 - - [09/May/2003:03:46:15 +0200] "ãA" 200 6617 "-" "-"
66.74.204.40 - - [09/May/2003:03:47:17 +0200] "ãA" 200 6617 "-" "-"
217.235.22.155 - - [09/May/2003:03:58:38 +0200] "ãL" 200 6619 "-" "-"
217.235.22.155 - - [09/May/2003:03:59:23 +0200] "ãL" 200 6619 "-" "-"
200.40.225.210 - - [09/May/2003:03:59:34 +0200] "ã=" 200 6619 "-" "-"
217.235.22.155 - - [09/May/2003:04:00:08 +0200] "ãL" 200 6619 "-" "-"
217.234.189.246 - - [09/May/2003:04:00:59 +0200] "ã=" 200 6620 "-" "-"
80.144.22.228 - - [09/May/2003:04:01:28 +0200] "ãN" 200 6618 "-" "-"
217.234.189.246 - - [09/May/2003:04:01:48 +0200] "ã=" 200 6620 "-" "-"
80.144.22.228 - - [09/May/2003:04:02:12 +0200] "ãN" 200 6618 "-" "-"
217.234.189.246 - - [09/May/2003:04:02:41 +0200] "ã=" 200 6620 "-" "-"
80.144.22.228 - - [09/May/2003:04:02:57 +0200] "ãN" 200 6618 "-" "-"
since 8th may they're some of these entries, mostly a few times from
the same ip and the requests change a bit. Anybody has seen that before?
or know anything about it? I quickchecked bugtraq for something like
that but didn't found something.
Regards,
Sven
| < Previous | Next > |