httpd weird logs

dominant · 02-06-2005, 04:29 AM

Hi to all

I checked the error_log of the apache (apache-1.3.28-77)
and i noticed the following

Code:

gunzip: stdout: Broken pipe

gunzip: stdout: Broken pipe

gunzip: stdout: Broken pipe

Do you know what does this mean?

dominant · 02-07-2005, 09:53 AM

any ideas?

Capt_Caveman · 02-07-2005, 11:17 PM

My first thoughts were that it might be a failed part of an exploit or at least someone remotely using apache to upload and unpack a file. However, there aren't any known public vulnerabilities with that Apache version that would allow remote arbitrary code execution under normal circumstances, though your Apache version is old vulnerable to several local exploits and should be upgraded to a more recent version. Of course that doesn't rule out a 0-day Apache exploit.

The other possibility would be something got borked during a logrotate session or an Apache restart (some of the config and modules are compressed), so you might want to take a look at the times of those errors and compare them to your http log rotation schedule or to any Apache restarts.

dominant · 02-08-2005, 05:42 AM

Hello.

I have patched the apache with the latest patch that Suse issued (apache-1.3.28-77). (is apache still vulnerable???)

The errors have nothing to do with log rotation.
These errors should be reported to the /var/log/messages then.(if i am right)