Re: HTTP break in attempt? (Buffer overrun?)

[Sean /The RIMBoy/ <sean@rimboy.com>]

On Mon, 6 Aug 2001, SILUG wrote:

> In my "access_log" file under /var/log/httpd, I find a LOT of lines
> like this:
> 
> 24.217.106.237 - - [06/Aug/2001:19:56:13 -0500] "GET /default.ida?XXXXXXXXXXX

> Is this someone trying to do some funny "buffer overrun" stuff?  The IP address
> is not always the same.
> 
> I'm wondering if this is the result of some stupid IIS server that's
> been infected by the "Code Red" virus.

Yes.  

Sean...

-- 
WWJD?  JWRTFM.     -ASO/.
_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
KG4NRC
www.rimboy.com		<-- Your source for the crap you know you need.

-
To unsubscribe, send email to majordomo@silug.org with
"unsubscribe silug-discuss" in the body.