Interesting entry in my web server logs. Someone has an infected/hacked computer..:-)
Posted : June 2, 2004 at 6:59 pm [America/Los_Angeles]
Here’s what I had in my error_log:
[Wed Jun 02 03:30:21 2004] [error] [client 69.81.6.80] request failed: URI too long (longer than 8190)
A quick nslookup gave me:
Name: user-12l21ig.cable.mindspring.com Address: 69.81.6.80
The access_log had the following (abbreviated version):
69.81.6.80 - - [02/Jun/2004:03:30:21 -0400] "SEARCH /x90x02xb1x02xb1x02xb1x02 xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1 x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02 xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1 x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02 xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1 x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02 xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1 x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02xb1x02 xb1x02xb1x02xb1x02xb1x02xb1x02xb1 ...
…
0x90x90x90x90x90x90x90x90x90x90x90x90″ 414 437
A quick wc -c showed that this crap goes on for 29231 characters!
Should I do something about it?
Update:
Thanks to Jason, I got this link which basically sums this entry up rather well:
“It is an IIS WebDAV exploit from April 2003 (?), apache is not affected, its just annoying 
(nachi and agobot use this exploit)”
- Anand
Category: Security |
Viewed: 1980 times
3 Comments »
Depends on whether your server can be manipulated or not
http://lists.freebsd.org/pipermail/freebsd-questions/2004-March/042170.html
And if you don’t want it to polute your access log, then apply some filtering capability before it hits your server.
Otherwise, ignore it :p
Posted by: Jason Barker at June 2, 2004 @ 7:34 pm
Thanks for the link Jason. It sure helps to “know” what in the world it is. I will update my blog entry to reflect the link you gave.
It sure would be nice to keep it from polluting my log. Will try to play around with mod_rewrite settings and see if that helps.
Posted by: Anand Sharma at June 2, 2004 @ 8:03 pm
thanks for the info!
Posted by: robert at April 20, 2006 @ 5:21 am
Leave a Comment