Disturbing news, it looks like the apache abend we had this morning was directly related to the strange web-log entries I reported a couple of days ago. We got this in the abend-log:
The "B102B102" is the exact hex-code of the strange SEARCH request recorded in my apache logs. The difference here is that the server that received the request was running NetStorage. I don't know the exact mechanism for how EIP got to where it was, or how the stack got overwritten, but that isn't good. Not good at all. I'm trying to get a hold of Novell to notify them of this.
*********************************************************
Server FACSRV2 halted Monday, March 29, 2004 7:00:05.556 am
Abend 1 on P00: Server-5.60.04: Page Fault Processor Exception (Error code 00000000)
Registers:
CS = 0008 DS = 0010 ES = 0010 FS = 0010 GS = 0010 SS = 0010
EAX = CCBFC308 EBX = B102B102 ECX = 8C992A10 EDX = 00000090
ESI = CCC16A88 EDI = CCA37C00 EBP = 952B26A8 ESP = 90444FD4
EIP = B102B102 FLAGS = 00010286
Address (0xB102B102) exceeds valid memory limit
EIP in UNKNOWN memory area
Access Location: 0xB102B102
The violation occurred while processing the following instruction:
Running process: Apache 33 Process
Thread Owned by NLM: APACHE.NLM
Stack pointer: 90444718
OS Stack limit: 90431220
Scheduling priority: 67371008
Wait state: 3030070 Yielded CPU
Stack: --B102B102 ?
--B102B102 ?
--B102B102 ?
--B102B102 ?
--B102B102 ?
--B102B102 ?
--B102B102 ?
The "B102B102" is the exact hex-code of the strange SEARCH request recorded in my apache logs. The difference here is that the server that received the request was running NetStorage. I don't know the exact mechanism for how EIP got to where it was, or how the stack got overwritten, but that isn't good. Not good at all. I'm trying to get a hold of Novell to notify them of this.