[Apache2] What the heck happened here?

[Glaanieboy]

(see attached part of the Apache2 httpd log)
What the heck happened here, that is what I want to know. I have never seen this loooong 'search' string. What did it search for, can it hurt, does it have consequenses (sp)?
BTW, I traced the IP back to a client who uses the same ISP as I use (Wanadoo Cable NL), so I can easily track the user down if necessary.

 

[vern]

Maybe someone trying to do a buffer-overflow? If it didn't affect anything ... Your version is probably patched against it.

 

[j79zlr]

Maybe someone trying to do a buffer-overflow? If it didn't affect anything ... Your version is probably patched against it.

Agrees, also if you contact your/their ISP, they probably won't do anything unfortunately.

 

[cryogenic]

I agree... looks like a buffer overflow exploit. Looks kinda neat in notepad with wordwrap on

 

[Skwowwy]

Upgrade your Apache2 server to the latest version just in case.

Also, try to configure the search program to limit the number of characters that can be used. So before Apache evaluates the search parameters fully (i.e. before it starts searching), it's already returning an error that the search string is too long. Or something like that.

Unless I misunderstood what "Search" does there. I'm thinking of a search program on your hosted site, like the Google and Altavista ones. Ya know. xD Oh well.

 

[sean.ferguson]

yeah glaanie, do a cvsup just in case. Make sure everything is up to date

 

[X-Istence]

It is a Sploit for IIS (I see it all the time on servers i admin). But like the others said, just update. And better be safe than sorry.

 

[Glaanieboy]

Hehe, I should have said it's running on Windows XP ...
Anyway, it is the latest version (as of 3 weeks ago) and since it's an IIS exploit, I don't need to worry Thanks guys

(ps, please no flaming because I use XP+apache as a webserver, my freebsd server was broken, so I had to )

 

[sean.ferguson]

yeah fix the server

 

[Glaanieboy]

yeah fix the server

Almost, almost. Just got Samba3 running and I am ready to transfer the backups back to the server. Then all I have to do is import MySQL tables + data, reroute the internal IP, then I am all set