From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from ms-smtp-01-smtplb.tampabay.rr.com ([65.32.5.131] helo=ms-smtp-01.tampabay.rr.com) by speech.braille.uwo.ca with esmtp (Exim 3.36 #1 (Debian)) id 1BxF2m-0001G9-00 for ; Tue, 17 Aug 2004 21:15:12 -0400 Received: from bupster.cjb.net (163-193.35-65.tampabay.rr.com [65.35.193.163]) by ms-smtp-01.tampabay.rr.com (8.12.10/8.12.7) with ESMTP id i7I1F7jK027035 for ; Tue, 17 Aug 2004 21:15:10 -0400 (EDT) Received: from richard (163-193.35-65.tampabay.rr.com [65.35.193.163]) by bupster.cjb.net (8.12.11/8.12.8) with SMTP id i7I1F6mZ019561 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO) for ; Tue, 17 Aug 2004 21:15:07 -0400 Message-ID: <004901c484c0$d0736ff0$5202a8c0@richard> From: "Richard Wells" To: "Speakup is a screen review system for Linux." Date: Tue, 17 Aug 2004 21:15:12 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Virus-Scanned: Symantec AntiVirus Scan Engine Subject: Fw: Log Watch Whackiness Since Installing Fedora Core 2 X-BeenThere: speakup@braille.uwo.ca X-Mailman-Version: 2.1.4 Precedence: list Reply-To: "Speakup is a screen review system for Linux." List-Id: "Speakup is a screen review system for Linux." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Aug 2004 01:15:12 -0000 Here's the solution to a question I asked and never got answered. Dave has kindly provided this valuable information. Maybe other Fedora FC2 users will find it helpful. Thanks to Dave for the useful information ----- Original Message ----- From: "Dave Strauss" To: Sent: Tuesday, August 17, 2004 4:45 PM Subject: re: Log Watch Whackiness Since Installing Fedora Core 2 Richard, I came across your post on the speakup mailing list archives, and I just wanted to give you some of that "any help" you asked for. I noticed the same problem (it actually prevented logwatch from sending me its daily email on occassion) and tracked it down to a bug in the exploit-parsing code in the http logwatch script. The records are, of course, buffer-overflow exploits aimed at IIS so they're of no real concern for an Apache installation, but the http script doesn't identify the records properly due to an error in the way the exploit-matching strings are defined. The good news is that it's easily fixable, either by upgrading to the latest version of logwatch (I believe they're up to 5.2.something) or by editing the http script to fix the bug. In FC2, this is /etc/log.d/scripts/services/http; you can modify it by looking for the following lines: '\\x90\\x02\\xb1\\x02\\xb1', '\\x02\\xb1\\x02\\xb1', '\\x90\\x90\\x90\\x90', '\\x04\\x01', '\\x05\\x01', and changing them to: '\\\x90\\\x02\\\xb1\\\x02\\\xb1', '\\\x02\\\xb1\\\x02\\\xb1', '\\\x90\\\x90\\\x90\\\x90', '\\\x04\\\x01', '\\\x05\\\x01', Yes, indeed, yet another REGEXP-not-enough-backslashes bug. Hope this helps. You might want to post this to the list since I'm not a contributor. Regards. -- Dave Strauss dstrauss@alum.mit.edu http://www.waltzking.org On Sun May 30 17:16:31 EDT 2004, Richard Wells wrote: > Hello List, > > Ever since installing Fedora Core 2, I have been getting the strangest Log > Watch message sent to root. I normally like reading them to get the latest > activity on my machine but now some really whacky stuff is getting > prepended to this daily generated message. How can I get rid of this error > or whatever is causing this garbage to appear in my Log Watch messages? > > Thanks > > A portion of the text appears below: > > ################### LogWatch 5.1 (02/03/04) > #################### > Processing Initiated: Sun May 30 04:02:09 2004 > Date Range Processed: yesterday > Detail Level of Output: 0 > Logfiles for Host: bupster.cjb.net > ################################################################ > > --------------------- httpd Begin ------------------------ > > A total of 2 unidentified 'other' records logged > SEARCH > /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 > > > Any help is appreciated! > >