some funkness resulting from the Security Update 1.0

holmBrew

holmBrew

Official Volunteer
after installing today's security update, apache throws this error on start up:

*** log/apacheLog/error_log ***
Processing config directory: /private/etc/httpd/users
Processing config file: /private/etc/httpd/users/admin.conf
Processing config file: /private/etc/httpd/users/holmberg.conf
[Fri Apr 5 17:27:46 2002] [warn] Loaded DSO /usr/libexec/httpd/mod_caucho.so uses plain Apache 1.3 API, this module might crash under EAPI! (please recompile it with -DEAPI)
[Fri Apr 5 17:27:46 2002] [warn] module mod_caucho.c is already added, skipping
[Fri Apr 5 17:27:47 2002] [warn] module mod_hfs_apple.c is already added, skipping
[Fri Apr 5 17:27:47 2002] [warn] pid file /private/var/run/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
[Fri Apr 5 17:27:47 2002] [notice] Apache/1.3.23 (Darwin) Resin/2.0.2 PHP/4.1.2 DAV/1.0.2 configured -- resuming normal operations
[Fri Apr 5 17:27:47 2002] [notice] Accept mutex: flock (Default: flock)


anyone else get this?
 
This basically forces you to rebuild apache, webdav, and php...and maybe mysql if you have that installed
 
If I understand well, this log file would be found at the end of the following path : /var/log/apacheLog/error_log ? If yes, I can safely say that I don't have such a log on my Mac, yet I use Apache to (playfully) serve the following useless website : http://plessard.no-ip.org/ and it correctly works after the April 2002 update...
 
true, the path to my logs is different from the default. your logs are found in:
/var/logs/httpd/
 
I checked my error_log also. I'm not seeing anything unusual. Granted my system may not be set up like yours. So, if the new security update did break your Apache setup, it would have to be something you setup that is out of the ordinary. How differently is your setup? Say compared to a normal generic Apache setup?

SA :)
 
First of all... HolmBrew, I really like your avatar ! :D

This said, I read the Apache log, (found here : /var/logs/httpd/error_log) and I noticed that every single time my Apache server is restarted, I get these errors :
Code: 
[Sat Apr  6 08:58:34 2002] [error] [client x.x.x.x] File does not exist: /Library/WebServer/Documents/c/winnt/system32/cmd.exe
[Sat Apr  6 08:58:34 2002] [error] [client x.x.x.x] File does not exist: /Library/WebServer/Documents/d/winnt/system32/cmd.exe
[Sat Apr  6 08:58:34 2002] [error] [client x.x.x.x] File does not exist: /Library/WebServer/Documents/scripts/..%5c../winnt/system32/cmd.exe
[Sat Apr  6 08:58:34 2002] [error] [client x.x.x.x] File does not exist: /Library/WebServer/Documents/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Sat Apr  6 08:58:34 2002] [error] [client x.x.x.x] File does not exist: /Library/WebServer/Documents/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Sat Apr  6 08:58:34 2002] [error] [client x.x.x.x] File does not exist: /Library/WebServer/Documents/msadc/..%5c../..%5c../..%5c/..¡../..¡../..¡../winnt/system32/cmd.exe
[Sat Apr  6 08:58:34 2002] [error] [client x.x.x.x] File does not exist: /Library/WebServer/Documents/scripts/..¡../winnt/system32/cmd.exe
[Sat Apr  6 08:58:35 2002] [error] [client x.x.x.x] File does not exist: /Library/WebServer/Documents/scripts/..¿Ø../winnt/system32/cmd.exe
[Sat Apr  6 08:58:35 2002] [error] [client x.x.x.x] File does not exist: /Library/WebServer/Documents/scripts/..¡ú../winnt/system32/cmd.exe
[Sat Apr  6 08:58:35 2002] [error] [client x.x.x.x] File does not exist: /Library/WebServer/Documents/scripts/..%5c../winnt/system32/cmd.exe
[Sat Apr  6 08:58:35 2002] [error] [client x.x.x.x] File does not exist: /Library/WebServer/Documents/scripts/..%2f../winnt/system32/cmd.exe
I use the standard Apple-provided Apache build. Am I the only one with these error messages ?

The warning you noticed yesterday are nowhere to be found in my computer's Apache error_log however...
 
i suggest moving all that junk out of /Library/WebServer/Documents/ and restart apache...it doesn't look like anything for your Mac, considering the ".exe" file extentions.
 
Those .exe files are being called by a worm infected NT server. The server is basically a zombie and tried to request those exe files with a malformed url so they can hijack another NT server that isn't updated.

Of course, this is Apache, so we don't have those exe files for it to get, so it's just getting 404 errors and you're getting messy logs. Nothing you can do short of contacting the owner of the server and/or banning the requesting IP
 
You must log in or register to reply here.
Back
Top