Security Basics mailing list archives

Tomcat and IIS Redirect Logs


From: Robert McCall <chrisb30 () bellsouth net>
Date: 23 Sep 2003 23:28:08 -0000



I am receiving these message in my IIS Redirect Logs.  I have had to sanitize the path due to sensitive information.  
Has anyone seen this?  It appears to me to have started being thrown when TomCat was first installed and then it is on 
and off from there. I suspect this to be a technical error in Tomcat rather than an exploit, but can anyone help me 
confirm that?

[Wed May 14 15:04:19 2003]  [jk_isapi_plugin.c (644)]: HttpFilterProc 
[/censored/meta-inf/services/javax.print.printservicelookup] points to the web-inf or meta-inf directory.
Somebody try to hack into the site!!!
[Fri May 16 17:16:58 2003]  [jk_isapi_plugin.c (644)]: HttpFilterProc 
[/censored/meta-inf/services/javax.print.printservicelookup] points to the web-inf or meta-inf directory.
Somebody try to hack into the site!!!
[Tue May 20 14:42:52 2003]  [jk_isapi_plugin.c (644)]: HttpFilterProc 
[/censored/meta-inf/services/javax.print.printservicelookup] points to the web-inf or meta-inf directory.
Somebody try to hack into the site!!!
[Wed May 21 17:53:45 2003]  [jk_isapi_plugin.c (588)]: HttpFilterProc [/] contains forbidden escape sequences.
[Wed May 21 17:53:45 2003]  [jk_isapi_plugin.c (588)]: HttpFilterProc [/] contains forbidden escape sequences.
[Wed May 21 17:53:50 2003]  [jk_isapi_plugin.c (588)]: HttpFilterProc [/] contains forbidden escape sequences.
[Wed May 21 17:54:00 2003]  [jk_isapi_plugin.c (644)]: HttpFilterProc [//web-inf] points to the web-inf or meta-inf 
directory.
Somebody try to hack into the site!!!
[Wed May 21 18:18:26 2003]  [jk_isapi_plugin.c (588)]: HttpFilterProc [///] contains forbidden escape sequences.
[Wed May 21 18:18:31 2003]  [jk_isapi_plugin.c (588)]: HttpFilterProc [/censoredcensored/censored///] contains 
forbidden escape sequences.
[Wed May 21 18:18:33 2003]  [jk_isapi_plugin.c (588)]: HttpFilterProc [/censoredcensored/censored/censored///] contains 
forbidden escape sequences.
[Wed May 21 18:18:35 2003]  [jk_isapi_plugin.c (588)]: HttpFilterProc [/censoredcensored/censored/censored/censored///] 
contains forbidden escape sequences.
[Thu May 22 10:13:50 2003]  [jk_isapi_plugin.c (644)]: HttpFilterProc 
[/censored/meta-inf/services/javax.print.printservicelookup] points to the web-inf or meta-inf directory.
Somebody try to hack into the site!!!
[Thu May 22 16:43:21 2003]  [jk_isapi_plugin.c (644)]: HttpFilterProc 
[/censored/meta-inf/services/javax.print.printservicelookup] points to the web-inf or meta-inf directory.
Somebody try to hack into the site!!!

---------------------------------------------------------------------------
----------------------------------------------------------------------------


Current thread: