Attachment 308315 Details for Bug 449880 – Brief collection of log file snippets

Brief collection of log file snippets

http_errors.log (text/plain), 3.21 KB, created by Austin on 2008-06-04 03:34:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Austin

Created: 2008-06-04 03:34:18 UTC

Size: 3.21 KB

patch

obsolete

>modsec_audit.log.4:1956:HTTP/1.1 501 Method Not Implemented
>modsec_audit.log.4:1963:Message: Access denied with code 501 (phase 2). Pattern match "(?:\\b(?:\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\.asa|httpd\\.conf|boot\\.ini)\\b|\\/etc\\/)" at ARGS:comment. [id "950005"] 
>[msg "Remote File Access Attempt. Matched signature </etc/>"] [severity "CRITICAL"]
>modsec_audit.log.4:1992:HTTP/1.1 501 Method Not Implemented
>modsec_audit.log.4:1999:Message: Access denied with code 501 (phase 2). Pattern match "(?:\\b(?:\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\.asa|httpd\\.conf|boot\\.ini)\\b|\\/etc\\/)" at ARGS:comment. [id "950005"] 
>[msg "Remote File Access Attempt. Matched signature </etc/>"] [severity "CRITICAL"]
>modsec_audit.log.4:2028:HTTP/1.1 501 Method Not Implemented
>modsec_audit.log.4:2035:Message: Access denied with code 501 (phase 2). Pattern match 
>"(?:\\b(?:(?:n(?:et(?:\\b\\W+?\\blocalgroup|\\.exe)|(?:map|c)\\.exe)|t(?:racer(?:oute|t)|elnet\\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\\.exe|echo\\b\\W*?\\by+)\\b|c(?:md(?:(?:32)?\\.exe\\b|\\b\\W*?\\/c)|d(?:\\b\\W*?[\\\\/]|\\W*?\\.\\.)|hmod.{0,40}? 
>..." at ARGS:comment. [id "950006"] [msg "System Command Injection. Matched signature <`uname>"] [severity "CRITICAL"]
>modsec_audit.log.4:2064:HTTP/1.1 501 Method Not Implemented
>modsec_audit.log.4:2071:Message: Access denied with code 501 (phase 2). Pattern match 
>"(?:\\b(?:(?:n(?:et(?:\\b\\W+?\\blocalgroup|\\.exe)|(?:map|c)\\.exe)|t(?:racer(?:oute|t)|elnet\\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\\.exe|echo\\b\\W*?\\by+)\\b|c(?:md(?:(?:32)?\\.exe\\b|\\b\\W*?\\/c)|d(?:\\b\\W*?[\\\\/]|\\W*?\\.\\.)|hmod.{0,40}? 
>..." at ARGS:comment. [id "950006"] [msg "System Command Injection. Matched signature <`uname>"] [severity "CRITICAL"]
>modsec_audit.log.4:2100:HTTP/1.1 501 Method Not Implemented
>modsec_audit.log.4:2107:Message: Access denied with code 501 (phase 2). Pattern match 
>"(?:\\b(?:(?:n(?:et(?:\\b\\W+?\\blocalgroup|\\.exe)|(?:map|c)\\.exe)|t(?:racer(?:oute|t)|elnet\\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\\.exe|echo\\b\\W*?\\by+)\\b|c(?:md(?:(?:32)?\\.exe\\b|\\b\\W*?\\/c)|d(?:\\b\\W*?[\\\\/]|\\W*?\\.\\.)|hmod.{0,40}? 
>..." at ARGS:comment. [id "950006"] [msg "System Command Injection. Matched signature <` uname>"] [severity "CRITICAL"]
>modsec_debug.log:83:[02/Jun/2008:17:14:40 +091800] [elmo/sid#2aaab8feea60][rid#2aaabe283b88][/bugzilla/process_bug.cgi][1] Access denied with code 501 (phase 2). Pattern match 
>"(?:\\b(?:\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\.asa|httpd\\.conf|boot\\.ini)\\b|\\/etc\\/)" at ARGS:comment. [id "950005"] [msg "Remote File Access Attempt. Matched signature </etc/>"] [severity "CRITICAL"]
>ssl_access_log:396:192.168.4.111 - - [02/Jun/2008:17:14:40 +0930] "POST /bugzilla/process_bug.cgi HTTP/1.1" 501 312
>ssl_error_log:94:[Mon Jun 02 17:14:40 2008] [error] [client 192.168.4.111] ModSecurity: Access denied with code 501 (phase 2). Pattern match 
>"(?:\\\\b(?:\\\\.(?:ht(?:access|passwd|group)|www_?acl)|global\\\\.asa|httpd\\\\.conf|boot\\\\.ini)\\\\b|\\\\/etc\\\\/)" at ARGS:comment. [id "950005"] [msg "Remote File Access Attempt. Matched signature </etc/>"] 
>[severity "CRITICAL"] [hostname "elmo"] [uri "/bugzilla/process_bug.cgi"] [unique_id "Kw0WKH8AAAEAAAsBpkkAAAAC"]
>

Actions: View

Attachments on bug 449880: 308315