Fw: Log Watch Whackiness Since Installing Fedora Core 2

[Richard Wells]

Here's the solution to  a question I asked and never got answered. Dave has 
kindly provided this valuable information. Maybe other Fedora FC2 users will 
find it helpful.

Thanks to Dave for the useful information

----- Original Message ----- 
From: "Dave Strauss" <dstrauss at alum.mit.edu>
To: <richwels at bupster.cjb.net>
Sent: Tuesday, August 17, 2004 4:45 PM
Subject: re: Log Watch Whackiness Since Installing Fedora Core 2


Richard,

I came across your post on the speakup mailing list archives, and I
just wanted to give you some of that "any help" you asked for.  I
noticed the same problem (it actually prevented logwatch from sending
me its daily email on occassion) and tracked it down to a bug in the
exploit-parsing code in the http logwatch script.

The records are, of course, buffer-overflow exploits aimed at IIS so
they're of no real concern for an Apache installation, but the http
script doesn't identify the records properly due to an error in the
way the exploit-matching strings are defined.

The good news is that it's easily fixable, either by upgrading to the
latest version of logwatch (I believe they're up to 5.2.something) or
by editing the http script to fix the bug.  In FC2, this is
/etc/log.d/scripts/services/http; you can modify it by looking for the
following lines:
   '\\x90\\x02\\xb1\\x02\\xb1',
   '\\x02\\xb1\\x02\\xb1',
   '\\x90\\x90\\x90\\x90',
   '\\x04\\x01',
   '\\x05\\x01',

and changing them to:
   '\\\x90\\\x02\\\xb1\\\x02\\\xb1',
   '\\\x02\\\xb1\\\x02\\\xb1',
   '\\\x90\\\x90\\\x90\\\x90',
   '\\\x04\\\x01',
   '\\\x05\\\x01',

Yes, indeed, yet another REGEXP-not-enough-backslashes bug.

Hope this helps.  You might want to post this to the list since
I'm not a contributor.

Regards.

-- Dave Strauss
   dstrauss at alum.mit.edu
   http://www.waltzking.org


On Sun May 30 17:16:31 EDT 2004, Richard Wells <richwels at bupster.cjb.net> 
wrote:
> Hello List,
>
> Ever since installing Fedora Core 2, I have been getting the strangest Log
> Watch message sent to root. I normally like reading them to get the latest
> activity on my machine but now some really whacky stuff is getting
> prepended to this daily generated message. How can I get rid of this error
> or whatever is causing this garbage to appear in my Log Watch messages?
>
> Thanks
>
> A portion of the  text appears below:
>
> ################### LogWatch 5.1 (02/03/04)
> ####################
>        Processing Initiated: Sun May 30 04:02:09 2004
>        Date Range Processed: yesterday
>      Detail Level of Output: 0
>           Logfiles for Host: bupster.cjb.net
>  ################################################################
>
>  --------------------- httpd Begin ------------------------
>
> A total of 2 unidentified 'other' records logged
>   SEARCH
> /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0
>
>
> Any help is appreciated!
>
>