Anyone else seeing this in their logs files?

URL too long (error 414) - What are they trying to achieve?

[MountainAsh]

Over the last few day I have seen a number of log file entries like :

61.****.79.129 - - [03/Apr/2004:16:39:20 +0100] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02....

where the hex codes vary and continue for over 20,000 characters. The web server logs it as an error 414 (URL too long) but I was wondering what loophole the "hacker" was attempting to exploit.

This particular IP traces back to Korea but I have seen the same thing coming in from other IP address in Russia.

Is anyone else getting these entries in their logfiles?

.

[asquithea]

I'd guess that they're attempting a buffer overflow exploit of some kind against your server. Make sure that you're up-to-date with your patches.