Return-Path: <sentto-279987-1524-996674433-fc=all.net@returns.onelist.com> Delivered-To: fc@all.net Received: from 204.181.12.215 by localhost with POP3 (fetchmail-5.1.0) for fc@localhost (single-drop); Wed, 01 Aug 2001 07:01:17 -0700 (PDT) Received: (qmail 7569 invoked by uid 510); 1 Aug 2001 13:02:57 -0000 Received: from n25.groups.yahoo.com (216.115.96.75) by 204.181.12.215 with SMTP; 1 Aug 2001 13:02:57 -0000 X-eGroups-Return: sentto-279987-1524-996674433-fc=all.net@returns.onelist.com Received: from [10.1.4.54] by mv.egroups.com with NNFMP; 01 Aug 2001 14:00:34 -0000 X-Sender: jacobson@mitre.org X-Apparently-To: iwar@yahoogroups.com Received: (EGP: mail-7_2_0); 1 Aug 2001 14:00:32 -0000 Received: (qmail 11597 invoked from network); 1 Aug 2001 13:49:41 -0000 Received: from unknown (10.1.10.26) by l8.egroups.com with QMQP; 1 Aug 2001 13:49:41 -0000 Received: from unknown (HELO smtpproxy2.mitre.org) (128.29.154.90) by mta1 with SMTP; 1 Aug 2001 13:49:40 -0000 Received: from avsrv2.mitre.org (avsrv2.mitre.org [128.29.154.4]) by smtpproxy2.mitre.org (8.11.3/8.11.3) with ESMTP id f71DneG11428 for <iwar@yahoogroups.com>; Wed, 1 Aug 2001 09:49:40 -0400 (EDT) Received: from MAILHUB2 (mailhub2.mitre.org [129.83.221.18]) by smtpsrv2.mitre.org (8.11.3/8.11.3) with ESMTP id f71DndI24557 for <iwar@yahoogroups.com>; Wed, 1 Aug 2001 09:49:39 -0400 (EDT) Received: from dhcp-163-203.mitre.org (128.29.163.203) by mailhub2.mitre.org with SMTP id 7325749; Wed, 01 Aug 2001 09:49:37 -0400 Message-ID: <3B680975.398D8770@mitre.org> Organization: The MITRE Corporation X-Mailer: Mozilla 4.76C-20010313M (Macintosh; U; PPC) X-Accept-Language: en,ru,de,pdf To: iwar@yahoogroups.com References: <200108011237.FAA24677@big.all.net> From: "L.C.J. Jacobson" <jacobson@mitre.org> Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com Delivered-To: mailing list iwar@yahoogroups.com Precedence: bulk List-Unsubscribe: <mailto:iwar-unsubscribe@yahoogroups.com> Date: Wed, 01 Aug 2001 09:51:49 -0400 Reply-To: iwar@yahoogroups.com Subject: Re: [iwar] China trying it again... Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit > From my web logs this morning... a China-originated buffer overflow attempt... > > 202.98.111.242 user 2001/08/01 08:14:14 19044 32608 Error - Can't stat file - GET > /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN...N > %u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090 > %u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a This is a Code Red worm scan. It is possible that more of these will show up in all our logs, from China and lots of other places. -jake _________________________________________________________________ L.C.J. Jacobson jacobson@mitre.org 703-883-6982 The MITRE Corporation http://www.mitre.org ------------------------ Yahoo! Groups Sponsor ---------------------~--> Secure your servers with 128-bit SSL encryption! Grab your copy of VeriSign's FREE Guide: "Securing Your Web Site for Business." Get it Now! http://www.verisign.com/cgi-bin/go.cgi?a=n094442340008000 http://us.click.yahoo.com/n7RbFC/zhwCAA/yigFAA/kgFolB/TM ---------------------------------------------------------------------~-> ------------------ http://all.net/ Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
This archive was generated by hypermail 2.1.2 : 2001-09-29 21:08:38 PDT