Security

Ask something
Discussion Locked

Weird entry on port 80 ISA

0 helpful
6 replies

by iplogic

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Weird entry on port 80 ISA
Can anyone be as kind as to tell me what this is ?

(66.76.49.132 anonymous - N 2003-07-1401:01:24 w3proxy name - - - - - 3818 3562 - GET http://33.90.33.99/default.ida? XXXXXXXXXff%u0078%u0000%u00=a - - 401 )

( Ihave shorten entries considerably for ease of reading and modified IP adress for security reason , I am sure you'll understand)

How can I block this request from being executed or accepted.

Help...and Thank you in advance for your help.

6 replies

by joematus

CodeRed II -- make sure your IIS servers are patched. CodeRed II has been out for about two years now and some folks haven't patched their servers.

by iplogic

Thanks for the sugestion, However our
IIS is and has been uptodate with patches, Our Antyvirus Software Checks for updates daily and has the latest deffinitions. This entry was found on our ISA Web Log. With the anonimous IP address changing daily.....???

by beermonster

Hi,
If you're system is patched then you shouldn't have a problem. the get command is attempting a known buffer overflow which will fail on a patched system. Bear in mind that patching cannot prevent someone TRYING to hack your system - as is the case here - but it does prevent the hack succeeding....

This discussion is closed to new replies.