[suse-security] New(?) exploit for webservers?

[Sven 'Darkman' Michels <sven@xxxxxxxxxx>]

evening,

i noticed some weird logentries in my apache access log:

57.67.127.228 - - [09/May/2003:02:23:32 +0200] "ãB" 200 6618 "-" "-"
57.67.127.228 - - [09/May/2003:02:48:19 +0200] "ãB" 200 6618 "-" "-"
57.67.127.228 - - [09/May/2003:03:18:09 +0200] "ãB" 200 6618 "-" "-"
66.74.204.40 - - [09/May/2003:03:45:11 +0200] "ãA" 200 6617 "-" "-"
66.74.204.40 - - [09/May/2003:03:46:15 +0200] "ãA" 200 6617 "-" "-"
66.74.204.40 - - [09/May/2003:03:47:17 +0200] "ãA" 200 6617 "-" "-"
217.235.22.155 - - [09/May/2003:03:58:38 +0200] "ãL" 200 6619 "-" "-"
217.235.22.155 - - [09/May/2003:03:59:23 +0200] "ãL" 200 6619 "-" "-"
200.40.225.210 - - [09/May/2003:03:59:34 +0200] "ã=" 200 6619 "-" "-"
217.235.22.155 - - [09/May/2003:04:00:08 +0200] "ãL" 200 6619 "-" "-"
217.234.189.246 - - [09/May/2003:04:00:59 +0200] "ã=" 200 6620 "-" "-"
80.144.22.228 - - [09/May/2003:04:01:28 +0200] "ãN" 200 6618 "-" "-"
217.234.189.246 - - [09/May/2003:04:01:48 +0200] "ã=" 200 6620 "-" "-"
80.144.22.228 - - [09/May/2003:04:02:12 +0200] "ãN" 200 6618 "-" "-"
217.234.189.246 - - [09/May/2003:04:02:41 +0200] "ã=" 200 6620 "-" "-"
80.144.22.228 - - [09/May/2003:04:02:57 +0200] "ãN" 200 6618 "-" "-"

since 8th may they're some of these entries, mostly a few times from
the same ip and the requests change a bit. Anybody has seen that before?
or know anything about it? I quickchecked bugtraq for something like
that but didn't found something.

Regards,
Sven


--
Check the headers for your unsubscription address
For additional commands, e-mail: suse-security-help@xxxxxxxx
Security-related bug reports go to security@xxxxxxx, not here