[Xitami] A Hack Attempt or What?

[GunnarSwan]

Im running NT 4 and have secured as a bastion type host, removing Windows Networking and performing other security measures.

In my Xitami Access and Error logs, I have found the following ... this being only one of the items. There are about 5-10, all from different IP addresses.

203.250.84.135 - - [04/Aug/2001:05:20:54 -0800] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a%20 HTTP/1.0" 404 0 "" ""

I am suspecting someone is attempting a buffer overrun attack. Can anyone help me understand what has happen here?  My machine works just fine. I am searching my HD for stuff I didn't put there. Any clues here?  Thanks.


Best Regards,
Gunnar Swan
Find the best deals on the web at AltaVista Shopping!
http://www.shopping.altavista.com