Here's the solution to a question I asked and never got answered. Dave has kindly provided this valuable information. Maybe other Fedora FC2 users will find it helpful. Thanks to Dave for the useful information ----- Original Message ----- From: "Dave Strauss" <dstrauss@xxxxxxxxxxxx> To: <richwels at bupster.cjb.net> Sent: Tuesday, August 17, 2004 4:45 PM Subject: re: Log Watch Whackiness Since Installing Fedora Core 2 Richard, I came across your post on the speakup mailing list archives, and I just wanted to give you some of that "any help" you asked for. I noticed the same problem (it actually prevented logwatch from sending me its daily email on occassion) and tracked it down to a bug in the exploit-parsing code in the http logwatch script. The records are, of course, buffer-overflow exploits aimed at IIS so they're of no real concern for an Apache installation, but the http script doesn't identify the records properly due to an error in the way the exploit-matching strings are defined. The good news is that it's easily fixable, either by upgrading to the latest version of logwatch (I believe they're up to 5.2.something) or by editing the http script to fix the bug. In FC2, this is /etc/log.d/scripts/services/http; you can modify it by looking for the following lines: '\\x90\\x02\\xb1\\x02\\xb1', '\\x02\\xb1\\x02\\xb1', '\\x90\\x90\\x90\\x90', '\\x04\\x01', '\\x05\\x01', and changing them to: '\\\x90\\\x02\\\xb1\\\x02\\\xb1', '\\\x02\\\xb1\\\x02\\\xb1', '\\\x90\\\x90\\\x90\\\x90', '\\\x04\\\x01', '\\\x05\\\x01', Yes, indeed, yet another REGEXP-not-enough-backslashes bug. Hope this helps. You might want to post this to the list since I'm not a contributor. Regards. -- Dave Strauss dstrauss at alum.mit.edu http://www.waltzking.org On Sun May 30 17:16:31 EDT 2004, Richard Wells <richwels at bupster.cjb.net> wrote: > Hello List, > > Ever since installing Fedora Core 2, I have been getting the strangest Log > Watch message sent to root. I normally like reading them to get the latest > activity on my machine but now some really whacky stuff is getting > prepended to this daily generated message. How can I get rid of this error > or whatever is causing this garbage to appear in my Log Watch messages? > > Thanks > > A portion of the text appears below: > > ################### LogWatch 5.1 (02/03/04) > #################### > Processing Initiated: Sun May 30 04:02:09 2004 > Date Range Processed: yesterday > Detail Level of Output: 0 > Logfiles for Host: bupster.cjb.net > ################################################################ > > --------------------- httpd Begin ------------------------ > > A total of 2 unidentified 'other' records logged > SEARCH > /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 > > > Any help is appreciated! > >
