Update: Stopping NIMDA in Apache

[Patrick Fleming]

Quoting "J.Francois" <frenchie@magusnet.com>:
All well and good except CR ignores attempts to connect to 127.* and 224.* which 
is what I assume you are attempting to do with the *.ida exploit.

Patrick

> Here is a better writeup:
> 
> ---CUT HERE---
> 
> <Directory "/var/www/htdocs">
> 
> #
> # This may also be "None", "All", or any combination of "Indexes",
> # "Includes", "FollowSymLinks", "ExecCGI", or "MultiViews".
> #
> # Note that "MultiViews" must be named *explicitly* --- "Options All"
> # doesn't give it to you.
> #
>     Options Indexes FollowSymLinks
> 
> #
> # This controls which options the .htaccess files in directories can
> # override. Can also be "All", or any combination of "Options",
> "FileInfo",
> # "AuthConfig", and "Limit"
> #
>     AllowOverride None
> 
>     RedirectMatch (.*)\cmd.exe$ http://127.0.0.1
>     RedirectMatch (.*)\default.ida$ http://127.0.0.1
>     RedirectMatch (.*)\root.exe$ http://127.0.0.1
> 
> #
> # Controls who can get stuff from this server.
> #
>     Order allow,deny
>     Allow from all
> </Directory>
> 
> 
> ---CUT HERE---
> 
> --
> Jean Francois - JLF Sends...
> My MagusNet Public Proxy In the News:
> 
http://www.missinformation.com/Archives/ReadArchives.dbm?ID=352&GetCategories=No
ne
> http://www.usatoday.com/life/cyber/tech/2001/09/12/ebrief.htm
> http://www.salon.com/tech/feature/2001/09/14/privacy/index.html
> 
http://www.boston.com/dailyglobe2/260/business/New_wiretap_rules_may_alter_Inter
net_s_landscape+.shtml
> 
> ________________________________________________
> See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't
> post to the list quickly and you use Netscape to write mail.
> 
> PLUG-discuss mailing list  -  PLUG-discuss@lists.PLUG.phoenix.az.us
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>