lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <3F50122BC3EAB6428FC4A24F675C222D0C4D6E@HQWIRMEXCH06.hq.ins>
From: Karl.Levinson at dhs.gov (Levinson, Karl)
Subject: SEARCH web attack

Google it:

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=SEARCH-%2F%5Cx90%5Cx0
2%C2%B1

This is presumably an attempt to exploit the MS03-007 NTDLL vulnerability
via WebDAV.

http://archives.neohapsis.com/archives/sf/pentest/2003-03/0109.html
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.jb.h
tml
http://www.microsoft.com/technet/security/bulletin/MS03-007.mspx

Other people have seen the following requests in their web server logs:
SEARCH /AAAAAAAAA...  or   SEARCH /?.?.?.?.?.?.?....


-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of i.t Consulting
Sent: Wednesday, March 31, 2004 1:39 PM
To: full-disclosure@...ts.netsys.com
Subject: [despammed] [Full-Disclosure] SEARCH web attack


during March the apache log shows some SEARCH attacks like "SEARCH
/\x90\x02?\x02? ... x90\x90" 414 343 "-" "-"

see full examples
http://thum.ath.cx/Apache/code.414

can someone enlighten me what the wanted result may be?
tia


Powered by blists - more mailing lists