Re: Strange CONNECT entries in apache logs

From: Thomas Jensen (securityfocusat_private)
Date: Wed Jun 11 2003 - 00:53:17 PDT

  • Next message: Ronald Belchez: "Re: strange traffic on UDP port 53"

    Rajkumar S wrote:
    > Hi,
    > 
    > While going through my apache logs, I found some logs indicating CONNECT 
    > requests to port 25 of other hosts.
    > 
    > 213.130.24.192 [06/Jun/2003:08:44:58 +0530] "CONNECT 194.67.23.20:25 
    > HTTP/1.1" 302 5 "-" "-"
    > 130.94.247.248 [06/Jun/2003:10:26:17 +0530] "CONNECT 207.44.188.67:25 
    > HTTP/1.0" 200 14409 "-" "-"
    > 130.94.247.248 [06/Jun/2003:09:56:21 +0530] "CONNECT smtp.rol.ru:25 
    > HTTP/1.0" 200 17757 "-" "-"
    
    I just looked in my logs and found the same (CONNECT with a 200 code).
    However it might not be the problem it seems to be. I tried connecting 
    with telnet and execute a CONNECT command - the result was a 200 code 
    and the output of my own /index.php page.
    I have found several references to this being a PHP4 bug, which can 
    happen when you have an index.php file and a DirectoryIndex index.php 
    directive in you Apache conf.
    
    Best regards
    Thomas Jensen
    
    
    ----------------------------------------------------------------------------
    ----------------------------------------------------------------------------
    



    This archive was generated by hypermail 2b30 : Wed Jun 11 2003 - 14:05:27 PDT