You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by George Hester <he...@hotmail.com> on 2002/07/25 21:25:52 UTC
Weird errors in iis_redirect.log
This is using Tomacat with IIS 5 Windows 2000 and the ISAPI available here:
http://members.ozemail.com.au/~lampante/howto/tomcat/iisnt/#2
In my log I am getting very many errors all the same and they are:
[Sat Jul 20 23:23:56 2002] [jk_isapi_plugin.c (588)]: HttpFilterProc
[/scripts/..�/../winnt/system32/cmd.exe] contains forbidden escape sequences.
Many of these; all the same; except the date changes. They seem to occur every
hour.
Can I stop this and if so can you suuggest how? Thanks.
--
George Hester
_________________________________
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Weird errors in iis_redirect.log
Posted by George Hester <he...@hotmail.com>.
Yes but read the thread above. Something very bad has happened. But fixable.
--
George Hester
_________________________________
"Mike Jackson" <mj...@cdi-hq.com> wrote in message
news:DDEPJBPNFOMNALFBBLMMCEOHDNAA.mjackson@cdi-hq.com...
> If you're getting those messages in your tomcat connector log then I'd
> think you're probably doing some forwarding. Do you have jsp's working?
>
> --mikej
> -=-----
> mike jackson
> mjackson@cdi-hq.com
>
> -----Original Message-----
> From: news [mailto:news@main.gmane.org]On Behalf Of George Hester
> Sent: Thursday, July 25, 2002 1:37 PM
> To: tomcat-user@jakarta.apache.org
> Subject: Re: Weird errors in iis_redirect.log
>
>
> No don't forward anything that I know of to Tomcat. Let's put it this way I
> considered forwarding stuff to Tomcat but for one thing I do not know how.
> I'd
> like to forward jsp's to Tomecat but there is no script mapping executable
> in
> Tomcat to do that that I know of anyway. JRun eh? Junked that. That is
> why I
> am using Tomcat now. Because even though JRun 4 had a beautiful mapping dll
> for
> IIS it killed all ASP sessions on the server. I had to remove it..
>
> --
> George Hester
> _________________________________
> "Mike Jackson" <mj...@cdi-hq.com> wrote in message
> news:DDEPJBPNFOMNALFBBLMMMEOEDNAA.mjackson@cdi-hq.com...
> > Are you sure you're not forwarding everything to tomcat? That would still
> > indicate someone trying to hack you. As to why they're not in the IIS
> log,
> > I have no clue. I don't use IIS and tomcat, only apache and tomcat. For
> > IIS I typically use jrun.
> >
> > --mikej
> > -=-----
> > mike jackson
> > mjackson@cdi-hq.com
> >
> > -----Original Message-----
> > From: news [mailto:news@main.gmane.org]On Behalf Of George Hester
> > Sent: Thursday, July 25, 2002 12:57 PM
> > To: tomcat-user@jakarta.apache.org
> > Subject: Re: Weird errors in iis_redirect.log
> >
> >
> > Then why no http error? I know what you are referring to. I don't think
> > that
> > is the case here. This is an error reported by the ntiis_redirect.dll
> ISAPI
> > that came from the site I listed. These errors are not occurring in the
> IIS
> > logs but in the log that was made from the link I gave you. Notice the
> > [jk_isapi_plugin.c (588)]:
> >
> > --
> > George Hester
> > _________________________________
> > "Mike Jackson" <mj...@cdi-hq.com> wrote in message
> > news:DDEPJBPNFOMNALFBBLMMOEOCDNAA.mjackson@cdi-hq.com...
> > > There's a filter that you can install in IIS to block those (see
> > microsoft's
> > > web site, I don't remember the exact name but it's something like
> > > urlfilter).
> > > But what you're seeing is people trying to hack your box through known
> IIS
> > > security holes.
> > >
> > > --mikej
> > > -=-----
> > > mike jackson
> > > mjackson@cdi-hq.com
> > >
> > > -----Original Message-----
> > > From: news [mailto:news@main.gmane.org]On Behalf Of George Hester
> > > Sent: Thursday, July 25, 2002 12:26 PM
> > > To: tomcat-user@jakarta.apache.org
> > > Subject: Weird errors in iis_redirect.log
> > >
> > >
> > > This is using Tomacat with IIS 5 Windows 2000 and the ISAPI available
> > here:
> > >
> > > http://members.ozemail.com.au/~lampante/howto/tomcat/iisnt/#2
> > >
> > > In my log I am getting very many errors all the same and they are:
> > >
> > > [Sat Jul 20 23:23:56 2002] [jk_isapi_plugin.c (588)]: HttpFilterProc
> > > [/scripts/..�/../winnt/system32/cmd.exe] contains forbidden escape
> > > sequences.
> > >
> > > Many of these; all the same; except the date changes. They seem to
> occur
> > > every
> > > hour.
> > >
> > > Can I stop this and if so can you suuggest how? Thanks.
> > >
> > > --
> > > George Hester
> > > _________________________________
> > >
> > >
> > >
> > >
> > >
> > > --
> > > To unsubscribe, e-mail:
> > > <ma...@jakarta.apache.org>
> > > For additional commands, e-mail:
> > > <ma...@jakarta.apache.org>
> >
> >
> >
> >
> >
> > --
> > To unsubscribe, e-mail:
> > <ma...@jakarta.apache.org>
> > For additional commands, e-mail:
> > <ma...@jakarta.apache.org>
>
>
>
>
>
> --
> To unsubscribe, e-mail:
> <ma...@jakarta.apache.org>
> For additional commands, e-mail:
> <ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Weird errors in iis_redirect.log
Posted by Mike Jackson <mj...@cdi-hq.com>.
If you're getting those messages in your tomcat connector log then I'd
think you're probably doing some forwarding. Do you have jsp's working?
--mikej
-=-----
mike jackson
mjackson@cdi-hq.com
-----Original Message-----
From: news [mailto:news@main.gmane.org]On Behalf Of George Hester
Sent: Thursday, July 25, 2002 1:37 PM
To: tomcat-user@jakarta.apache.org
Subject: Re: Weird errors in iis_redirect.log
No don't forward anything that I know of to Tomcat. Let's put it this way I
considered forwarding stuff to Tomcat but for one thing I do not know how.
I'd
like to forward jsp's to Tomecat but there is no script mapping executable
in
Tomcat to do that that I know of anyway. JRun eh? Junked that. That is
why I
am using Tomcat now. Because even though JRun 4 had a beautiful mapping dll
for
IIS it killed all ASP sessions on the server. I had to remove it..
--
George Hester
_________________________________
"Mike Jackson" <mj...@cdi-hq.com> wrote in message
news:DDEPJBPNFOMNALFBBLMMMEOEDNAA.mjackson@cdi-hq.com...
> Are you sure you're not forwarding everything to tomcat? That would still
> indicate someone trying to hack you. As to why they're not in the IIS
log,
> I have no clue. I don't use IIS and tomcat, only apache and tomcat. For
> IIS I typically use jrun.
>
> --mikej
> -=-----
> mike jackson
> mjackson@cdi-hq.com
>
> -----Original Message-----
> From: news [mailto:news@main.gmane.org]On Behalf Of George Hester
> Sent: Thursday, July 25, 2002 12:57 PM
> To: tomcat-user@jakarta.apache.org
> Subject: Re: Weird errors in iis_redirect.log
>
>
> Then why no http error? I know what you are referring to. I don't think
> that
> is the case here. This is an error reported by the ntiis_redirect.dll
ISAPI
> that came from the site I listed. These errors are not occurring in the
IIS
> logs but in the log that was made from the link I gave you. Notice the
> [jk_isapi_plugin.c (588)]:
>
> --
> George Hester
> _________________________________
> "Mike Jackson" <mj...@cdi-hq.com> wrote in message
> news:DDEPJBPNFOMNALFBBLMMOEOCDNAA.mjackson@cdi-hq.com...
> > There's a filter that you can install in IIS to block those (see
> microsoft's
> > web site, I don't remember the exact name but it's something like
> > urlfilter).
> > But what you're seeing is people trying to hack your box through known
IIS
> > security holes.
> >
> > --mikej
> > -=-----
> > mike jackson
> > mjackson@cdi-hq.com
> >
> > -----Original Message-----
> > From: news [mailto:news@main.gmane.org]On Behalf Of George Hester
> > Sent: Thursday, July 25, 2002 12:26 PM
> > To: tomcat-user@jakarta.apache.org
> > Subject: Weird errors in iis_redirect.log
> >
> >
> > This is using Tomacat with IIS 5 Windows 2000 and the ISAPI available
> here:
> >
> > http://members.ozemail.com.au/~lampante/howto/tomcat/iisnt/#2
> >
> > In my log I am getting very many errors all the same and they are:
> >
> > [Sat Jul 20 23:23:56 2002] [jk_isapi_plugin.c (588)]: HttpFilterProc
> > [/scripts/..À/../winnt/system32/cmd.exe] contains forbidden escape
> > sequences.
> >
> > Many of these; all the same; except the date changes. They seem to
occur
> > every
> > hour.
> >
> > Can I stop this and if so can you suuggest how? Thanks.
> >
> > --
> > George Hester
> > _________________________________
> >
> >
> >
> >
> >
> > --
> > To unsubscribe, e-mail:
> > <ma...@jakarta.apache.org>
> > For additional commands, e-mail:
> > <ma...@jakarta.apache.org>
>
>
>
>
>
> --
> To unsubscribe, e-mail:
> <ma...@jakarta.apache.org>
> For additional commands, e-mail:
> <ma...@jakarta.apache.org>
--
To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
For additional commands, e-mail:
<ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Weird errors in iis_redirect.log
Posted by George Hester <he...@hotmail.com>.
No don't forward anything that I know of to Tomcat. Let's put it this way I
considered forwarding stuff to Tomcat but for one thing I do not know how. I'd
like to forward jsp's to Tomecat but there is no script mapping executable in
Tomcat to do that that I know of anyway. JRun eh? Junked that. That is why I
am using Tomcat now. Because even though JRun 4 had a beautiful mapping dll for
IIS it killed all ASP sessions on the server. I had to remove it..
--
George Hester
_________________________________
"Mike Jackson" <mj...@cdi-hq.com> wrote in message
news:DDEPJBPNFOMNALFBBLMMMEOEDNAA.mjackson@cdi-hq.com...
> Are you sure you're not forwarding everything to tomcat? That would still
> indicate someone trying to hack you. As to why they're not in the IIS log,
> I have no clue. I don't use IIS and tomcat, only apache and tomcat. For
> IIS I typically use jrun.
>
> --mikej
> -=-----
> mike jackson
> mjackson@cdi-hq.com
>
> -----Original Message-----
> From: news [mailto:news@main.gmane.org]On Behalf Of George Hester
> Sent: Thursday, July 25, 2002 12:57 PM
> To: tomcat-user@jakarta.apache.org
> Subject: Re: Weird errors in iis_redirect.log
>
>
> Then why no http error? I know what you are referring to. I don't think
> that
> is the case here. This is an error reported by the ntiis_redirect.dll ISAPI
> that came from the site I listed. These errors are not occurring in the IIS
> logs but in the log that was made from the link I gave you. Notice the
> [jk_isapi_plugin.c (588)]:
>
> --
> George Hester
> _________________________________
> "Mike Jackson" <mj...@cdi-hq.com> wrote in message
> news:DDEPJBPNFOMNALFBBLMMOEOCDNAA.mjackson@cdi-hq.com...
> > There's a filter that you can install in IIS to block those (see
> microsoft's
> > web site, I don't remember the exact name but it's something like
> > urlfilter).
> > But what you're seeing is people trying to hack your box through known IIS
> > security holes.
> >
> > --mikej
> > -=-----
> > mike jackson
> > mjackson@cdi-hq.com
> >
> > -----Original Message-----
> > From: news [mailto:news@main.gmane.org]On Behalf Of George Hester
> > Sent: Thursday, July 25, 2002 12:26 PM
> > To: tomcat-user@jakarta.apache.org
> > Subject: Weird errors in iis_redirect.log
> >
> >
> > This is using Tomacat with IIS 5 Windows 2000 and the ISAPI available
> here:
> >
> > http://members.ozemail.com.au/~lampante/howto/tomcat/iisnt/#2
> >
> > In my log I am getting very many errors all the same and they are:
> >
> > [Sat Jul 20 23:23:56 2002] [jk_isapi_plugin.c (588)]: HttpFilterProc
> > [/scripts/..�/../winnt/system32/cmd.exe] contains forbidden escape
> > sequences.
> >
> > Many of these; all the same; except the date changes. They seem to occur
> > every
> > hour.
> >
> > Can I stop this and if so can you suuggest how? Thanks.
> >
> > --
> > George Hester
> > _________________________________
> >
> >
> >
> >
> >
> > --
> > To unsubscribe, e-mail:
> > <ma...@jakarta.apache.org>
> > For additional commands, e-mail:
> > <ma...@jakarta.apache.org>
>
>
>
>
>
> --
> To unsubscribe, e-mail:
> <ma...@jakarta.apache.org>
> For additional commands, e-mail:
> <ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Weird errors in iis_redirect.log
Posted by Mike Jackson <mj...@cdi-hq.com>.
Are you sure you're not forwarding everything to tomcat? That would still
indicate someone trying to hack you. As to why they're not in the IIS log,
I have no clue. I don't use IIS and tomcat, only apache and tomcat. For
IIS I typically use jrun.
--mikej
-=-----
mike jackson
mjackson@cdi-hq.com
-----Original Message-----
From: news [mailto:news@main.gmane.org]On Behalf Of George Hester
Sent: Thursday, July 25, 2002 12:57 PM
To: tomcat-user@jakarta.apache.org
Subject: Re: Weird errors in iis_redirect.log
Then why no http error? I know what you are referring to. I don't think
that
is the case here. This is an error reported by the ntiis_redirect.dll ISAPI
that came from the site I listed. These errors are not occurring in the IIS
logs but in the log that was made from the link I gave you. Notice the
[jk_isapi_plugin.c (588)]:
--
George Hester
_________________________________
"Mike Jackson" <mj...@cdi-hq.com> wrote in message
news:DDEPJBPNFOMNALFBBLMMOEOCDNAA.mjackson@cdi-hq.com...
> There's a filter that you can install in IIS to block those (see
microsoft's
> web site, I don't remember the exact name but it's something like
> urlfilter).
> But what you're seeing is people trying to hack your box through known IIS
> security holes.
>
> --mikej
> -=-----
> mike jackson
> mjackson@cdi-hq.com
>
> -----Original Message-----
> From: news [mailto:news@main.gmane.org]On Behalf Of George Hester
> Sent: Thursday, July 25, 2002 12:26 PM
> To: tomcat-user@jakarta.apache.org
> Subject: Weird errors in iis_redirect.log
>
>
> This is using Tomacat with IIS 5 Windows 2000 and the ISAPI available
here:
>
> http://members.ozemail.com.au/~lampante/howto/tomcat/iisnt/#2
>
> In my log I am getting very many errors all the same and they are:
>
> [Sat Jul 20 23:23:56 2002] [jk_isapi_plugin.c (588)]: HttpFilterProc
> [/scripts/..À/../winnt/system32/cmd.exe] contains forbidden escape
> sequences.
>
> Many of these; all the same; except the date changes. They seem to occur
> every
> hour.
>
> Can I stop this and if so can you suuggest how? Thanks.
>
> --
> George Hester
> _________________________________
>
>
>
>
>
> --
> To unsubscribe, e-mail:
> <ma...@jakarta.apache.org>
> For additional commands, e-mail:
> <ma...@jakarta.apache.org>
--
To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
For additional commands, e-mail:
<ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Weird errors in iis_redirect.log
Posted by George Hester <he...@hotmail.com>.
Then why no http error? I know what you are referring to. I don't think that
is the case here. This is an error reported by the ntiis_redirect.dll ISAPI
that came from the site I listed. These errors are not occurring in the IIS
logs but in the log that was made from the link I gave you. Notice the
[jk_isapi_plugin.c (588)]:
--
George Hester
_________________________________
"Mike Jackson" <mj...@cdi-hq.com> wrote in message
news:DDEPJBPNFOMNALFBBLMMOEOCDNAA.mjackson@cdi-hq.com...
> There's a filter that you can install in IIS to block those (see microsoft's
> web site, I don't remember the exact name but it's something like
> urlfilter).
> But what you're seeing is people trying to hack your box through known IIS
> security holes.
>
> --mikej
> -=-----
> mike jackson
> mjackson@cdi-hq.com
>
> -----Original Message-----
> From: news [mailto:news@main.gmane.org]On Behalf Of George Hester
> Sent: Thursday, July 25, 2002 12:26 PM
> To: tomcat-user@jakarta.apache.org
> Subject: Weird errors in iis_redirect.log
>
>
> This is using Tomacat with IIS 5 Windows 2000 and the ISAPI available here:
>
> http://members.ozemail.com.au/~lampante/howto/tomcat/iisnt/#2
>
> In my log I am getting very many errors all the same and they are:
>
> [Sat Jul 20 23:23:56 2002] [jk_isapi_plugin.c (588)]: HttpFilterProc
> [/scripts/..�/../winnt/system32/cmd.exe] contains forbidden escape
> sequences.
>
> Many of these; all the same; except the date changes. They seem to occur
> every
> hour.
>
> Can I stop this and if so can you suuggest how? Thanks.
>
> --
> George Hester
> _________________________________
>
>
>
>
>
> --
> To unsubscribe, e-mail:
> <ma...@jakarta.apache.org>
> For additional commands, e-mail:
> <ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Weird errors in iis_redirect.log
Posted by Mike Jackson <mj...@cdi-hq.com>.
There's a filter that you can install in IIS to block those (see microsoft's
web site, I don't remember the exact name but it's something like
urlfilter).
But what you're seeing is people trying to hack your box through known IIS
security holes.
--mikej
-=-----
mike jackson
mjackson@cdi-hq.com
-----Original Message-----
From: news [mailto:news@main.gmane.org]On Behalf Of George Hester
Sent: Thursday, July 25, 2002 12:26 PM
To: tomcat-user@jakarta.apache.org
Subject: Weird errors in iis_redirect.log
This is using Tomacat with IIS 5 Windows 2000 and the ISAPI available here:
http://members.ozemail.com.au/~lampante/howto/tomcat/iisnt/#2
In my log I am getting very many errors all the same and they are:
[Sat Jul 20 23:23:56 2002] [jk_isapi_plugin.c (588)]: HttpFilterProc
[/scripts/..À/../winnt/system32/cmd.exe] contains forbidden escape
sequences.
Many of these; all the same; except the date changes. They seem to occur
every
hour.
Can I stop this and if so can you suuggest how? Thanks.
--
George Hester
_________________________________
--
To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
For additional commands, e-mail:
<ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>