[Xitami] combat against cmd.exe

[M. Jason Smiley]

they won't harm xitami... other than fill up your log files.

if you want to stop them first - you need a good firewall in front of your
web server...


----- Original Message -----
From: "Robert J. DeMartini" <robdemartini@mindspring.com>
To: <xitami@lists.xitami.org>
Sent: Monday, July 01, 2002 2:14 PM
Subject: Re: [Xitami] combat against cmd.exe


> Thanks for the heads up... I didn't have a server up during the Nimda days
> but am well aware of this thing now. As with all the words of warning I
have
> my ftp secured and have a firewall (did that before I did anything else
> actually), I was actually wondering if there was a way for the server to
> block access to these attackers BEFORE they show up in my log. Judging
from
> what I've read I guess they will just pile up in the logs and continue to
> try and hack the server. (bastardos)
>
> Thanks,
>
> Rob
>
>
> ----- Original Message -----
> From: "eric hamel" <erh51@yahoo.com>
> To: <xitami@lists.xitami.org>
> Sent: Monday, July 01, 2002 7:15 AM
> Subject: Re: [Xitami] combat against cmd.exe
>
>
> > From what I've seen and read this is a Nimda attack
> > that's looking for an IIS server to nail. You don't
> > have to worry about it with Xitami. You should see my
> > logs! You get so you can even find the variations of
> > nimda <LOL>.
> >
> > If you want an excersize in frustration. Then track
> > down the servers admin and send them a letter about
> > it. But don't be surprised if it ends up in the trash
> > (using reciept requests). Most of them seem to ignore
> > them completely.
> >
> > I'd watch for ftp hacking attempts and definitely
> > setup a firewall to protect yourself.
> >
> > Good Luck.
> > Eric
> > --- "Robert J. DeMartini"
> > <robdemartini@mindspring.com> wrote:
> > > Hello,
> > >
> > > I'm interested to know what others are doing with
> > > Xitami to combat against
> > > this outside attack:
> > >
> > > /scripts/..%5c../winnt/system32/ cmd.exe
> > > /scripts/..%5c../winnt/ system32/cmd.exe?/c+dir
> > >
> > > and this:
> > >
> > > /scripts/..%5c../httpodbc.dll
> > >
> > > Shows up in my log files often. I'm assuming this is
> > > a NT vulnerability?
> > > Since I'm not running NT it's a fruitless attack but
> > > am concerned about
> > > other attacks I may encounter in the future and want
> > > to know if there is
> > > built in precautions.
> > >
> > > Thanks,
> > >
> > > Rob
> > >
> > >
> > > --
> > > Xitami Users Mailing List -- For Xitami support
> > > To unsubscribe:
> > http://lists.xitami.org/mailman/listinfo/xitami
> >
> >
> > __________________________________________________
> > Do You Yahoo!?
> > Yahoo! - Official partner of 2002 FIFA World Cup
> > http://fifaworldcup.yahoo.com
> >
> > --
> > Xitami Users Mailing List -- For Xitami support
> > To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
>