[oclug] httpd logs

[borg]

Ahhh... so that is the signature that code red attempts leave in the logs... 
interesting. I have read a several articles on it but have never seen 
"evidence" before. Thanks :-)

PS - I always have run apache as I have always enjoyed the virtualhost 
abilities over IIS. Not too mention the constent security nighmares of IIS. 
Just a quick peak around and I found about ten hosts susceptible to 
hexadecimal code exploits... YIKES!


Peter

---------------------


> >
> > GET /default.ida?NNNNNNNNNNNNNNNNNN
> > GET /default.ida?XXXXXXXXXXXXXXXXXX
>
> Typical of the "Code Red" exploit.  It only affects IIS.
> _______________________________________________
> oclug mailing list
> oclug at lists.oclug.on.ca
> http://www.oclug.on.ca/mailman/listinfo/oclug