Return-Path: <sentto-279987-1529-996685628-fc=all.net@returns.onelist.com> Delivered-To: fc@all.net Received: from 204.181.12.215 by localhost with POP3 (fetchmail-5.1.0) for fc@localhost (single-drop); Wed, 01 Aug 2001 10:08:08 -0700 (PDT) Received: (qmail 15246 invoked by uid 510); 1 Aug 2001 16:09:31 -0000 Received: from n19.groups.yahoo.com (216.115.96.69) by 204.181.12.215 with SMTP; 1 Aug 2001 16:09:31 -0000 X-eGroups-Return: sentto-279987-1529-996685628-fc=all.net@returns.onelist.com Received: from [10.1.4.54] by mw.egroups.com with NNFMP; 01 Aug 2001 17:07:08 -0000 X-Sender: fc@big.all.net X-Apparently-To: iwar@yahoogroups.com Received: (EGP: mail-7_2_0); 1 Aug 2001 17:07:07 -0000 Received: (qmail 80955 invoked from network); 1 Aug 2001 16:27:11 -0000 Received: from unknown (10.1.10.27) by l8.egroups.com with QMQP; 1 Aug 2001 16:27:11 -0000 Received: from unknown (HELO big.all.net) (65.0.156.78) by mta2 with SMTP; 1 Aug 2001 16:27:11 -0000 Received: (from fc@localhost) by big.all.net (8.9.3/8.7.3) id JAA26823 for iwar@yahoogroups.com; Wed, 1 Aug 2001 09:27:11 -0700 Message-Id: <200108011627.JAA26823@big.all.net> To: iwar@yahoogroups.com In-Reply-To: <3B680975.398D8770@mitre.org> from "L.C.J. Jacobson" at Aug 01, 2001 09:51:49 AM Organization: I'm not allowed to say X-Mailer: don't even ask X-Mailer: ELM [version 2.5 PL1] From: Fred Cohen <fc@all.net> Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com Delivered-To: mailing list iwar@yahoogroups.com Precedence: bulk List-Unsubscribe: <mailto:iwar-unsubscribe@yahoogroups.com> Date: Wed, 1 Aug 2001 09:27:11 -0700 (PDT) Reply-To: iwar@yahoogroups.com Subject: Re: [iwar] China trying it again... Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Per the message sent by L.C.J. Jacobson: > > From my web logs this morning... a China-originated buffer overflow attempt... > > > > 202.98.111.242 user 2001/08/01 08:14:14 19044 32608 Error - Can't stat file - GET > > /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN...N > > %u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090 > > %u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a > This is a Code Red worm scan. It is possible that more of these will > show up in all our logs, from China and lots of other places. Interesting - it represents a new part of the address apce for Code Red... IT never came to this IP in its last round... FC --This communication is confidential to the parties it is intended to serve-- Fred Cohen Fred Cohen & Associates.........tel/fax:925-454-0171 fc@all.net The University of New Haven.....http://www.unhca.com/ http://all.net/ Sandia National Laboratories....tel:925-294-2087 ------------------------ Yahoo! Groups Sponsor ---------------------~--> Small business owners... Tell us what you think! http://us.click.yahoo.com/vO1FAB/txzCAA/ySSFAA/kgFolB/TM ---------------------------------------------------------------------~-> ------------------ http://all.net/ Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
This archive was generated by hypermail 2.1.2 : 2001-09-29 21:08:38 PDT