Bugtraq mailing list archives
Re: Router Worm?
From: Jay Jacobson <jay () edgeos com>
Date: Wed, 19 Nov 2003 15:49:26 -0700 (MST)
On Wed, 19 Nov 2003, Chris Strom wrote:
I've received a strange HTTP request on my web site from two different sources. The request is logged as: SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02
[snip]
The request continues for a total of 32732 characters long (not shown).
[snip] Hi Chris. This is an IIS WebDAV exploit. For more information, check out: http://edgeos.com/threats/details.php?id=11413 http://www.fatelabs.com/library/fatelabs-ntdll-analysis.pdf ~Jay .. .. Jay Jacobson .. Edgeos, Inc. - 480.961.5996 - http://www.edgeos.com .. .. Managed Vulnerability Assessment .. Services for Information Security Professionals ..
Current thread:
- Router Worm? Chris Strom (Nov 19)
- Re: Router Worm? Fred Laxton (Nov 19)
- Re: Router Worm? Niels Bakker (Nov 19)
- Re: Router Worm? Jay Jacobson (Nov 19)
- <Possible follow-ups>
- RE: Router Worm? BugTrap (Nov 20)