topic Error in Apache Log File? in Operating System - HP-UX

Error in Apache Log File?

Ron Brown_2 — Thu, 19 Jun 2003 16:30:49 GMT

I found the following entry when I examined access_log on our web server:

65.73.180.156 - - [16/Jun/2003:13:36:07 -0500] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 276 "-" "-"

Some background: the site was hosted on a Linux box until recently and is now hosted under HP-UX 11.00. The log file was brought over from the Linux server. The Apache 1.3.26 is installed on both machines.

Is this an error, file corruption, or something more sinister?

Re: Error in Apache Log File?

Evert Jan van Ramselaar — Thu, 19 Jun 2003 17:25:55 GMT

These messages are traces of a worm querying your webserver. See http://www.datarescue.com/fprot/virinfo/defaultida.htm for more info.

Nothing to worry about. These things have become very common.

EJ

Re: Error in Apache Log File?

Michael Kelly_5 — Thu, 19 Jun 2003 17:25:59 GMT

Ron,
this is the 'signature' of the Code Red worm.
Last I heard, HPUX wasn't vulnerable!

Regards,
Michael.

Re: Error in Apache Log File?

Evert Jan van Ramselaar — Thu, 19 Jun 2003 17:28:01 GMT

True, only unpatched Microsoft IIS are vulnerable. It's just that the worm is searching for other unpatched IIS servers by trying the mentioned GET command.

EJ

Re: Error in Apache Log File?

Steven E. Protter — Thu, 19 Jun 2003 17:38:19 GMT

I see that on my Linux servers all the time.

Nice to know now why it happens.

You should continue to see this on HP-UX even though hou switched servers.

There should be a way to block these queries, but since they aren't dangerous, you can probably forget them.

If however I can associate an IP addy with this stuff, I'm going to forward it to the FBI, as should any good web hoster.

Someone is not playinig nicely or has been hacked.

SEP

Re: Error in Apache Log File?

Ron Brown_2 — Thu, 19 Jun 2003 20:01:06 GMT

I have to apologize for the formatting of the original post.

It's good to know what that is and that HP-UX is not affected.

I will now spend some time analyzing the logs more carefully for any other possible issues. Thanks!