[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: [Full-Disclosure] SEARCH web attack
- To: "'i.t Consulting'" <fulldis@xxxxxxxxxxxxxxx>, full-disclosure@xxxxxxxxxxxxxxxx
- Subject: RE: [Full-Disclosure] SEARCH web attack
- From: "Levinson, Karl" <Karl.Levinson@xxxxxxx>
- Date: Wed, 31 Mar 2004 14:23:09 -0500
Google it:
http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=SEARCH-%2F%5Cx90%5Cx0
2%C2%B1
This is presumably an attempt to exploit the MS03-007 NTDLL vulnerability
via WebDAV.
http://archives.neohapsis.com/archives/sf/pentest/2003-03/0109.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.jb.h
tml
http://www.microsoft.com/technet/security/bulletin/MS03-007.mspx
Other people have seen the following requests in their web server logs:
SEARCH /AAAAAAAAA... or SEARCH /?±±±±±±...
-----Original Message-----
From: full-disclosure-admin@xxxxxxxxxxxxxxxx
[mailto:full-disclosure-admin@xxxxxxxxxxxxxxxx] On Behalf Of i.t Consulting
Sent: Wednesday, March 31, 2004 1:39 PM
To: full-disclosure@xxxxxxxxxxxxxxxx
Subject: [despammed] [Full-Disclosure] SEARCH web attack
during March the apache log shows some SEARCH attacks like "SEARCH
/\x90\x02±\x02± ... x90\x90" 414 343 "-" "-"
see full examples
http://thum.ath.cx/Apache/code.414
can someone enlighten me what the wanted result may be?
tia
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html