[Xitami] A Hack Attempt or What?

[xitami@lists.xitami.org]

CODE RED!!! No worries for us Xitami users:-)
It's and attempt to exploit yet another security hole in IIS.

On Aug 05, 2001 09:59am, XITAMI@LISTS.XITAMI.ORG wrote to JOHN UHLIG:

 > Im running NT 4 and have secured as a bastion type host, removing Windows
 >  Networking and performing other security measures.

 > In my Xitami Access and Error logs, I have found the following ... this
 > being only one of the items. There are about 5-10, all from different IP
 > addresses.

 > 203.250.84.135 - - [04/Aug/2001:05:20:54 -0800] "GET
 > /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
 > NNNNNN
 > NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
 > NNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
 > NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
 > u7801%
 > u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0
 > 078%u0 000%u00=a%20 HTTP/1.0" 404 0 "" ""

 > I am suspecting someone is attempting a buffer overrun attack. Can anyone
 > help me understand what has happen here?  My machine works just fine. I
 > am searching my HD for stuff I didn't put there. Any clues here?  Thanks.


 > Best Regards,
 > Gunnar Swan
 > Find the best deals on the web at AltaVista Shopping!
 > http://www.shopping.altavista.com

 > --
 > Xitami Users Mailing List -- For Xitami support
 > To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami