Nimda attack on Tomcat

2003-08-04 Thread Abhinav Gautam
Hello,

Thanks everyone for help on the Tomcat with Virtual Hosting thread.
After analyzing the log files it seems that there was a Nimda worm attack
on the Tomcat webserver. Does any one have a fix for this?

Any help would be highly appreciated.

Thanks.
-abhinav





-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: Nimda attack on Tomcat

2003-08-04 Thread Shapira, Yoav

Howdy,
How did you reach this conclusion?  Do you have an IIS front-end or are
you running tomcat stand-alone?

Yoav Shapira
Millennium ChemInformatics


-Original Message-
From: Abhinav Gautam [mailto:[EMAIL PROTECTED]
Sent: Monday, August 04, 2003 3:22 PM
To: [EMAIL PROTECTED]
Subject: Nimda attack on Tomcat

Hello,

Thanks everyone for help on the Tomcat with Virtual Hosting thread.
After analyzing the log files it seems that there was a Nimda worm
attack
on the Tomcat webserver. Does any one have a fix for this?

Any help would be highly appreciated.

Thanks.
-abhinav





-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




This e-mail, including any attachments, is a confidential business communication, and 
may contain information that is confidential, proprietary and/or privileged.  This 
e-mail is intended only for the individual(s) to whom it is addressed, and may not be 
saved, copied, printed, disclosed or used by anyone else.  If you are not the(an) 
intended recipient, please immediately delete this e-mail from your computer system 
and notify the sender.  Thank you.


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Nimda attack on Tomcat

2003-08-04 Thread Tim Funk
Tomcat is immune to the nimbda/cod red/{IIS variant} attack. (Except for 
being DOS'd)

-Tim

Abhinav Gautam wrote:
Hello,

Thanks everyone for help on the Tomcat with Virtual Hosting thread.
After analyzing the log files it seems that there was a Nimda worm attack
on the Tomcat webserver. Does any one have a fix for this?
Any help would be highly appreciated.

Thanks.
-abhinav



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


RE: Nimda attack on Tomcat

2003-08-04 Thread Abhinav Gautam
Well, I analyzed my logs using Sawmill, and it said that there was a Nimda
attack. I guess as Tim said it was DOSed and not really exploited. No
I don't have an IIS front-end. I used to be running Apache on Tomcat, but
now after the incident I have Tomcat handle all requests directly.

thnx



On Mon, 4 Aug 2003, Shapira, Yoav wrote:

 
 Howdy,
 How did you reach this conclusion?  Do you have an IIS front-end or are
 you running tomcat stand-alone?
 
 Yoav Shapira
 Millennium ChemInformatics
 
 
 -Original Message-
 From: Abhinav Gautam [mailto:[EMAIL PROTECTED]
 Sent: Monday, August 04, 2003 3:22 PM
 To: [EMAIL PROTECTED]
 Subject: Nimda attack on Tomcat
 
 Hello,
 
 Thanks everyone for help on the Tomcat with Virtual Hosting thread.
 After analyzing the log files it seems that there was a Nimda worm
 attack
 on the Tomcat webserver. Does any one have a fix for this?
 
 Any help would be highly appreciated.
 
 Thanks.
 -abhinav
 
 
 
 
 
 -
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 
 
 
 
 This e-mail, including any attachments, is a confidential business communication, 
 and may contain information that is confidential, proprietary and/or privileged.  
 This e-mail is intended only for the individual(s) to whom it is addressed, and may 
 not be saved, copied, printed, disclosed or used by anyone else.  If you are not 
 the(an) intended recipient, please immediately delete this e-mail from your computer 
 system and notify the sender.  Thank you.
 
 
 -
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 
 



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Nimda attack on Tomcat

2003-08-04 Thread Tim Funk
If you use apache - you'd be better off since apache will return the 404 much 
quicker. ;)

-Tim

Abhinav Gautam wrote:
Well, I analyzed my logs using Sawmill, and it said that there was a Nimda
attack. I guess as Tim said it was DOSed and not really exploited. No
I don't have an IIS front-end. I used to be running Apache on Tomcat, but
now after the incident I have Tomcat handle all requests directly.
thnx



-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]