Does anyone recognise this pattern?

not sure if this is a search box flood

[jackson]

Checking through my logs just recently picked up this item:

s7a-4thstn-stpete-237.ij.net - - [21/Mar/2004:23:12:58 -0600] "SEARCH /\x90\x02\xb1\x02\xb1\x02\ .... \x90\x90" 414 271 "-" "-"

The space in between is filled with that "repeating" pattern "\x90\", etc. And this to the extent of 32,820 bytes.

Have been hit by this item twice in the last few days. Doesn't seem to have affected my site though.

I know that x90, etc. is hexidecimal for something - not sure what at this stage.

The question here is, is this something I should worry about and, if so, what to do about it?

[icpix]

That flavour of entry appears in my logs too.
I've always assumed them to be malicious buffer-overflow attempts, presumably aimed at non-Apache webservers.

best wishes, Robert

[bufferzone]

It is a IMAPD remote overflod. If you don't run a mailserver you don'r need to worry, If you do' follow the link and learn

[insecure.org...]

[bufferzone]

It could also be an attempt to try a buffer overflow in a popular CGI web counter, Count.cgi (wwwcount).

[attrition.org...]

[jackson]

Thanks all. Really appreciate the quick response and follow-up. Thought this was sort of "unfriendly". Guess this sort of stuff comes with the "territory" these days ...