<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>Attempted attack on apache</TITLE>
<META content="MSHTML 5.00.3315.2869" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT color=#0000ff face=Arial size=2><SPAN
class=865545209-08112002>Thanks. I've only ever run apache on an intranet before
and so have never seen this in a server log!</SPAN></FONT></DIV>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<DIV align=left class=OutlookMessageHeader dir=ltr><FONT face=Tahoma
size=2>-----Original Message-----<BR><B>From:</B> Daniel Andersson
[mailto:daniel@septum.org]<BR><B>Sent:</B> 08 November 2002
09:52<BR><B>To:</B> gllug@linux.co.uk<BR><B>Subject:</B> Re: [Gllug] Attempted
attack on apache<BR><BR></DIV></FONT>
<DIV><FONT size=2>that's nimda/code red (one of the two, me
thinks?)</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>if it's patched up to date you don't have to
worry</FONT></DIV>
<DIV><FONT size=2>and if you're running apache it doesn't matter, it only
affects IIS (and PWS?)</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>/ d</FONT></DIV>
<BLOCKQUOTE dir=ltr
style="BORDER-LEFT: #000000 2px solid; MARGIN-LEFT: 5px; MARGIN-RIGHT: 0px; PADDING-LEFT: 5px; PADDING-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A href="mailto:Adrian.McMenamin@britainineurope.org.uk"
title=Adrian.McMenamin@britainineurope.org.uk>Adrian McMenamin</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
href="mailto:'gllug@linux.co.uk'"
title=gllug@linux.co.uk>'gllug@linux.co.uk'</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Friday, November 08, 2002 9:46
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Gllug] Attempted attack on
apache</DIV>
<DIV><FONT size=2></FONT><BR></DIV>
<P><FONT face=Arial size=2>This is from a server log this morning. I assume
this is an attempted attack. Our server is patched up to date and I see no
signs of any problem. Am i reight to be assured?</FONT></P>
<P><FONT face=Arial size=2>pool0047.cvx14-bradley.dialup.earthlink.net - -
[08/Nov/2002:05:24:21 +0000] "GET
/default.ida?</FONT></P></BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>