Security Incidents mailing list archives

Re: Increase in MS vuln WebDav scans

From: <caldcv () students fccj org>
Date: 1 Jun 2004 17:13:11 -0000

In-Reply-To: <EB6D35AE1E5D3E40B4536F55B540A5D8013DDAE3 () ssdexch1 websense com>

68.252.34.20 - - [01/Jun/2004:04:59:58 -0400] "SEARCH /\x90\x02\xb1\x02\xb1\x02$

68.38.106.111 - - [01/Jun/2004:10:01:44 -0400] "SEARCH /\x90\x02\xb1\x02\xb1\x0$

Got some myself. I posted a post about this a few weeks ago and the moderator said that many worms out today like 
Ago/Phatbot use the WebDAV vulnerability in the worm. I just ignore them and rotate out my logs more because that 
particular scan takes like 34k of log space.

-CC

Current thread:

Increase in MS vuln WebDav scans Hubbard, Dan (Jun 01)
- <Possible follow-ups>
- Re: Increase in MS vuln WebDav scans caldcv (Jun 01)
  - Re: Increase in MS vuln WebDav scans Jose Nazario (Jun 02)
  - Re: Increase in MS vuln WebDav scans Cory Donnelly (Jun 02)