Latest LQ Deal: Linux Power User Bundle
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 09-15-2004, 10:27 PM   #1
LQ Guru
Registered: Apr 2003
Location: nottingham england
Distribution: Gentoo
Posts: 2,672

Rep: Reputation: 47
HELP ! very strange apache logs !

my apache2 access log....

{IP ADDRESS} - - [15/Sep/2004:23:09:10 +0100] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02
but the (is it hexidecimal ?) code coes on and on for pages !
what us this !

was some1 trying to exploit my box ! ?

the access error log shows...

[Wed Sep 15 23:09:10 2004] [error] [client (SAME IP ADDRESS)] request failed: URI too long (longer than 8190)
im running apache2.0.50

i assume they did not suceed in the exploit ?
otherwise they would have removed or fixed the logs ?

ALSO !!!!
im using the translucent windows patchfor KDE (unstable)
and as a result somtimes X restarts.. while it was doing this, i tried to get into a second login console (ctrl+alt+F2) there ALL dead... blank screens... even F1.

its likes like these i wish i had updated my tripwwire database !

Last edited by qwijibow; 09-15-2004 at 10:37 PM.
Old 09-15-2004, 11:17 PM   #2
Senior Member
Registered: Jun 2003
Distribution: Mint 13/15, CentOS 6.4
Posts: 2,020

Rep: Reputation: 47
i get those all the time. i think they are trying for buffer overflows on windoze boxes. so far they have been harmless on my server except for the annoyance and adding to the log.
Old 09-15-2004, 11:24 PM   #3
LQ Guru
Registered: Apr 2003
Location: nottingham england
Distribution: Gentoo
Posts: 2,672

Original Poster
Rep: Reputation: 47
yeah i assumed buffer overflow... but didnt know wether id be at risk.

any ideas about dissapearing agetty's ?

the 'top' program shows all my agetty's to be running..

confusing !


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Strange FTP logs dominant Linux - Security 1 08-24-2004 02:46 AM
apache logs showing strange "SEARCH /\x90\x02\xb1" lines TheOneAndOnlySM Linux - Software 1 06-28-2004 05:39 PM
Strange Apache LOGs... TheIrish Linux - Security 3 02-10-2004 02:15 PM
strange logs NSKL Slackware 2 10-24-2003 06:10 AM
Apache logs - ???Linux logs??? mylo2003 Linux - General 3 08-07-2003 05:49 PM > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 03:56 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration