Update: Stopping NIMDA in Apache

Top Page
Attachments:
Message as email
+ (text/plain)
Delete this message
Reply to this message
Author: Patrick Fleming
Date:  
Subject: Update: Stopping NIMDA in Apache
Quoting "J.Francois" <>:
All well and good except CR ignores attempts to connect to 127.* and 224.* which
is what I assume you are attempting to do with the *.ida exploit.

Patrick

> Here is a better writeup:
>
> ---CUT HERE---
>
> <Directory "/var/www/htdocs">
>
> #
> # This may also be "None", "All", or any combination of "Indexes",
> # "Includes", "FollowSymLinks", "ExecCGI", or "MultiViews".
> #
> # Note that "MultiViews" must be named *explicitly* --- "Options All"
> # doesn't give it to you.
> #
>     Options Indexes FollowSymLinks

>
> #
> # This controls which options the .htaccess files in directories can
> # override. Can also be "All", or any combination of "Options",
> "FileInfo",
> # "AuthConfig", and "Limit"
> #
>     AllowOverride None

>
>     RedirectMatch (.*)\cmd.exe$ http://127.0.0.1
>     RedirectMatch (.*)\default.ida$ http://127.0.0.1
>     RedirectMatch (.*)\root.exe$ http://127.0.0.1

>
> #
> # Controls who can get stuff from this server.
> #
>     Order allow,deny
>     Allow from all
> </Directory>

>
>
> ---CUT HERE---
>
> --
> Jean Francois - JLF Sends...
> My MagusNet Public Proxy In the News:
>

http://www.missinformation.com/Archives/ReadArchives.dbm?ID=352&GetCategories=No
ne
> http://www.usatoday.com/life/cyber/tech/2001/09/12/ebrief.htm
> http://www.salon.com/tech/feature/2001/09/14/privacy/index.html
>

http://www.boston.com/dailyglobe2/260/business/New_wiretap_rules_may_alter_Inter
net_s_landscape+.shtml
>
> ________________________________________________
> See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't
> post to the list quickly and you use Netscape to write mail.
>
> PLUG-discuss mailing list -
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>