Re: probmes with LogSQLMassVirtualHosting
| Newsgroups | gmane.comp.apache.mod-log-sql |
|---|---|
| Message-ID | <[email protected]> |
H
I'm sorry, I can't give you an example all evidense was removed, by the
technichian observing the problem, the same guy who told me it was version
1.20 (excuses, excuses ...) But I might try to explain the situation. We
use the LogSQLMassVirtualHosting feature.
Upon a request for cmd.exe with a long trail of %'s you know the trademarks
of the IIS worms like nimda it seems to confuse m_l_s making it belive that
the request was sent to a wierd domain with lots of funny characters in
it's name. m_l_s promptly creates a new table for this domain. It seems to
me that since theese requests were designed to overflow buffers they also
overflow some in the m_l_s.
Regard this as a FYI.
Feel free to get back to us for more info in case others also observe this
behaviour.
--
&ers
-------------------------------------
Anders Nygård
Västertorpsvägen 135
129 44 Hägersten Sweden
Phone 46-8-5222 35 00
Direct 46-8-5222 35 86
Mobile 46-73-988 65 86
www.x-source.se
"Chris Powell"
<[email protected] To: [email protected]
> cc:
Subject: Re: [mod_log_sql] probmes with LogSQLMassVirtualHosting
Sent by:
owner-mod_log_sql@gru
bbybaby.com
2003-02-19 19:08
Please respond to
mod_log_sql
>When we use the LogSQLMassVirtualHosting option with MySQL we get bogus
>tables on IIS worm requests, you now a'la nimda. Just want to inform about
>this and to perhaps get some answers regarding some way to avoid this
>while
>still using the LogSqlMassVirtualHosting feature. We use version 1.20.
Hmm...I'm not sure that I fully understand -- could you clarify for me
what you are seeing, perhaps with some example log entries?
The newest version of m_l_s is 1.18, btw... :-)
Regards,
Chris
__________________________________________________________________
Reminder: to unsubscribe, send email to <[email protected]>
with the words "unsubscribe mod_log_sql" in the body (w/o quotes).
The module homepage is http://www.grubbybaby.com/mod_log_sql/
__________________________________________________________________
Reminder: to unsubscribe, send email to <[email protected]>
with the words "unsubscribe mod_log_sql" in the body (w/o quotes).
The module homepage is http://www.grubbybaby.com/mod_log_sql/