Mailinglist Archive: opensuse-security (320 mails)

< Previous Next >
New(?) exploit for webservers?
  • From: Sven 'Darkman' Michels <sven@xxxxxxxxxx>
  • Date: Fri, 09 May 2003 04:18:04 +0200
  • Message-id: <3EBB0FDC.6060000@xxxxxxxxxx>
evening,

i noticed some weird logentries in my apache access log:

57.67.127.228 - - [09/May/2003:02:23:32 +0200] "ãB" 200 6618 "-" "-"
57.67.127.228 - - [09/May/2003:02:48:19 +0200] "ãB" 200 6618 "-" "-"
57.67.127.228 - - [09/May/2003:03:18:09 +0200] "ãB" 200 6618 "-" "-"
66.74.204.40 - - [09/May/2003:03:45:11 +0200] "ãA" 200 6617 "-" "-"
66.74.204.40 - - [09/May/2003:03:46:15 +0200] "ãA" 200 6617 "-" "-"
66.74.204.40 - - [09/May/2003:03:47:17 +0200] "ãA" 200 6617 "-" "-"
217.235.22.155 - - [09/May/2003:03:58:38 +0200] "ãL" 200 6619 "-" "-"
217.235.22.155 - - [09/May/2003:03:59:23 +0200] "ãL" 200 6619 "-" "-"
200.40.225.210 - - [09/May/2003:03:59:34 +0200] "ã=" 200 6619 "-" "-"
217.235.22.155 - - [09/May/2003:04:00:08 +0200] "ãL" 200 6619 "-" "-"
217.234.189.246 - - [09/May/2003:04:00:59 +0200] "ã=" 200 6620 "-" "-"
80.144.22.228 - - [09/May/2003:04:01:28 +0200] "ãN" 200 6618 "-" "-"
217.234.189.246 - - [09/May/2003:04:01:48 +0200] "ã=" 200 6620 "-" "-"
80.144.22.228 - - [09/May/2003:04:02:12 +0200] "ãN" 200 6618 "-" "-"
217.234.189.246 - - [09/May/2003:04:02:41 +0200] "ã=" 200 6620 "-" "-"
80.144.22.228 - - [09/May/2003:04:02:57 +0200] "ãN" 200 6618 "-" "-"

since 8th may they're some of these entries, mostly a few times from
the same ip and the requests change a bit. Anybody has seen that before?
or know anything about it? I quickchecked bugtraq for something like
that but didn't found something.

Regards,
Sven


< Previous Next >
Follow Ups