[Xitami] A Hack Attempt or What?

[xitami@lists.xitami.org]

When you say "infected" I assume that you consider it a virus - code red is
not a virus, it is just a simple command line (as seen in the log) sent to
exploit a particular security hole that exists (that is if you have not
applied the patch/fix) for Microsoft Internet Information Server (IIS) 3 and 4
I believe. So nothing has been "infected" -- at least not from the Code Red.
But watch out for the W32.Sircam.Worm@mm virus. Supposedly it only gets 98 and
ME boxes via mail readers like Outlook Express, or Outlook. You can read about
that and Code Red at http://www.sarc.com

-J

On Aug 05, 2001 11:38am, XITAMI@LISTS.XITAMI.ORG wrote to JOHN UHLIG:

 > Again, I am running Xitami on NT set up as a bastion host.
 > Is it safe to assume that all the IP addresses in my Access and Error
 > logs ... that all those machines have been infected?


 > On Sun, 05 August 2001, john.uhlig@coconutcomm.com wrote:

>>
>> CODE RED!!! No worries for us Xitami users:-)
>> It's and attempt to exploit yet another security hole in IIS.
>>
>> On Aug 05, 2001 09:59am, XITAMI@LISTS.XITAMI.ORG wrote to JOHN UHLIG:
>>
>>  > Im running NT 4 and have secured as a bastion type host, removing
>> Windows
>>  >  Networking and performing other security measures.
>>
>>  > In my Xitami Access and Error logs, I have found the following ... this
>>  > being only one of the items. There are about 5-10, all from different
>> IP
>>  > addresses.
>>
>>  > 203.250.84.135 - - [04/Aug/2001:05:20:54 -0800] "GET
>>  >
>> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>>  > NNNNNN
>>  >
>> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>>  > NNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>>  >
>> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
>>  > u7801%
>>  >
>> u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0
>>  > 078%u0 000%u00=a%20 HTTP/1.0" 404 0 "" ""
>>
>>  > I am suspecting someone is attempting a buffer overrun attack. Can
>> anyone
>>  > help me understand what has happen here?  My machine works just fine. I
>>  > am searching my HD for stuff I didn't put there. Any clues here?
>> Thanks.
>