What HTTP exploit?

Can anyone identify this http exploit? Seen in the apache logs:

foo.bar.com
- - [30/May/2004:02:45:28 -0400] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\
x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb
1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\
xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1

etc - and it goes on for about 1200 bytes.

Been getting an annoying number of these in my httpd logs today - it botches up my log analyser program.

Behalf Of John Palmer (NANOG Acct)
Sent: May 30, 2004 4:44 PM

Can anyone identify this http exploit? Seen in the apache logs:

foo.bar.com
- - [30/May/2004:02:45:28 -0400] "SEARCH
/\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\
x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb
1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb
1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\
xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\
xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1

etc - and it goes on for about 1200 bytes.

This is an older IIS WebDAV exploit. More info at
http://www.microsoft.com/technet/security/bulletin/ms03-007.mspx

You can mod_rewrite these attempts to /dev/null

RedirectMatch permanent (.*)\/x90\/(.*)$ /dev/null

Todd

It seems to be another stupid Microsoft Exploit that just causes annoyance
for Unix Boxes. The ones on my boxes seem to be about 32K in size and have
been occurring for the past 2 months or more. The only side effect is they
fill my dmesg logs with signal 11's from apache crashing.

pid 74210 (httpd), uid 80: exited on signal 11
pid 19971 (httpd), uid 80: exited on signal 11
pid 19969 (httpd), uid 80: exited on signal 11
pid 19970 (httpd), uid 80: exited on signal 11

Etc.

-- Matthew

i just installed the following in my apache configs to get rid of it:

# control logging
SetEnvIf Request_URI "^/default.ida?" dontlog
SetEnvIf Request_Method "SEARCH" dontlog

and then later on...

CustomLog /var/log/httpd/access_log combined env=!dontlog

between the two of them, they were consuming an absurd amount
of space in my /var/log partitions.

richard

Richard Welty [30/05/04 19:57 -0400]:

# control logging
SetEnvIf Request_URI "^/default.ida?" dontlog
SetEnvIf Request_Method "SEARCH" dontlog

Nathan Torkington's vermicide helps - (needs mod_perl)

  srs

# this goes into your httpd.conf file