Re: [squid-users] parseHttpRequest: Unsupported Method 'somestrangestring'

From: Ralf Hildebrandt <Ralf.Hildebrandt@dont-contact.us>
Date: Fri, 11 Apr 2003 23:10:40 +0200

* mailinglists <mailinglists@belfin.ch>:

> I got this here in my cache.log.
> Squid 2.3stable4 is restarting upon it. I think it's some kind of an attack.
>
> parseHttpRequest: Unsupported method 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b0
> 0%u531b%u53ff%u0078%u0000%u00=a'

Looks like a buffer overrun attempt with shellcode

-- 
Ralf Hildebrandt (Im Auftrag des Referat V a)   Ralf.Hildebrandt@charite.de
Charite Campus Mitte                            Tel.  +49 (0)30-450 570-155
Referat V a - Kommunikationsnetze -             Fax.  +49 (0)30-450 570-916
AIM: ralfpostfix
Received on Fri Apr 11 2003 - 15:10:47 MDT

This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 17:14:56 MST