access log

I have some access on my server that do the following:
"SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02\xb1\
-> for several lines and then :
\x90\x90 -> for several lines again

then after it does that :
142.217.93.222 - - [26/Mar/2004:06:55:33 -0500] "OPTIONS / HTTP/1.1"
200 -
142.217.93.222 - - [26/Mar/2004:06:55:33 -0500] "PROPFIND /SharedDocs
HTTP/1.1" 405 317
142.217.93.222 - - [26/Mar/2004:06:57:15 -0500] "OPTIONS / HTTP/1.1"
200 -
142.217.93.222 - - [26/Mar/2004:06:57:30 -0500] "PROPFIND
/Disque%20Dur%20Charles HTTP/1.1" 405 325
142.217.93.222 - - [26/Mar/2004:06:57:40 -0500] "PROPFIND
/Disque%20Dur%20Charles HTTP/1.1" 405 325
142.217.93.222 - - [26/Mar/2004:06:57:40 -0500] "PROPFIND
/Disque%20Dur%20Charles HTTP/1.1" 405 325
142.217.93.222 - - [26/Mar/2004:06:57:40 -0500] "PROPFIND
/Disque%20Dur%20Charles HTTP/1.1" 405 325

/Disque%20Dur%20Charles is the name of my hard drive

The IP is very similar to mine, mine is going 142.217.xxx.xxx too. I
don't know if its my ISP that tries to send something.

If you could help we take, i begin to be a little bit anxious with
that.

I'm using the version 2.0.49

Thank you

tolrahC wrote:
> I have some access on my server that do the following:
> "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\x b1\x02\xb1\x02\xb1\x02\xb1\
> -> for several lines and then :
> \x90\x90 -> for several lines again
>
> then after it does that :
> 142.217.93.222 - - [26/Mar/2004:06:55:33 -0500] "OPTIONS / HTTP/1.1"
> 200 -
> 142.217.93.222 - - [26/Mar/2004:06:55:33 -0500] "PROPFIND /SharedDocs
> HTTP/1.1" 405 317
> 142.217.93.222 - - [26/Mar/2004:06:57:15 -0500] "OPTIONS / HTTP/1.1"
> 200 -
> 142.217.93.222 - - [26/Mar/2004:06:57:30 -0500] "PROPFIND
> /Disque%20Dur%20Charles HTTP/1.1" 405 325
> 142.217.93.222 - - [26/Mar/2004:06:57:40 -0500] "PROPFIND
> /Disque%20Dur%20Charles HTTP/1.1" 405 325
> 142.217.93.222 - - [26/Mar/2004:06:57:40 -0500] "PROPFIND
> /Disque%20Dur%20Charles HTTP/1.1" 405 325
> 142.217.93.222 - - [26/Mar/2004:06:57:40 -0500] "PROPFIND
> /Disque%20Dur%20Charles HTTP/1.1" 405 325
>
> /Disque%20Dur%20Charles is the name of my hard drive
>
> The IP is very similar to mine, mine is going 142.217.xxx.xxx too. I
> don't know if its my ISP that tries to send something.
>
> If you could help we take, i begin to be a little bit anxious with
> that.
>
> I'm using the version 2.0.49
>
> Thank you

Looks like MS WebDav exploit:

http://support.microsoft.com/default...b;en-us;815021

You're fine with Apache...

Lac

> Looks like MS WebDav exploit:
>
> http://support.microsoft.com/default...b;en-us;815021
>
> You're fine with Apache...
>
> Lac


Thank you, i installed the patch and I hope it will work ;)