Increase in MS vuln WebDav scans

From: Hubbard, Dan (dhubbard_at_websense.com)
Date: 06/01/04

  • Next message: Levinson, Karl: "RE: NKADM rootkit - Something new?" 
    Date: Tue, 1 Jun 2004 08:03:19 -0700
To: <incidents@securityfocus.com>

    Has anyone else seen an increase in WebDav scans over the last couple
    weeks ? Mosty from University of Pen. ? We had not seen this for months
    until recently. Is there a worm that uses this vuln. ?
     
    Truncated cut samples:
    69.55.196.196 - - [29/May/2004:00:44:29 -0400] "SEARCH
    /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0
    2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0
    2

    69.192.170.241 - - [28/May/2004:08:23:30 -0400] "SEARCH
    /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0
    2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0
    2

    69.156.225.78 - - [27/May/2004:00:00:59 -0400] "SEARCH
    /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0
    2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0
    2

    69.14.84.117 - - [23/May/2004:09:20:49 -0400] "SEARCH
    /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0
    2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0
    2

     

  • Next message: Levinson, Karl: "RE: NKADM rootkit - Something new?"