1

My gerrit error log shows the following shell code like characters:

[HTTP-64] WARN  org.eclipse.jetty.http.HttpParser : Illegal character
0x5 in state=START for buffer
HeapByteBuffer@af151b6[p=1,l=3,c=8192,r=2]={\x05<<<\x01\x00>>>P\xC0c\xF660\x0000
OK\r\nDat...\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00}
[HTTP-64] WARN  org.eclipse.jetty.http.HttpParser : badMessage: 400
Illegal character 0x5 for
HttpChannelOverHttp@75f6292d{r=0,c=false,a=IDLE,uri=}

I suspect this may be a buffer overflow attack, but I can not confirm that it is. Does anyone know what it is?

  • @OskarSkog Then Its confirmly exploit attempt right? – SuperKrish Oct 31 '16 at 7:48
  • 1
    Yes, it's an exploit attempt, but so what? Most every IPv4 address sees dozens or hundreds of these per day; it's nothing special, and it doesn't mean your server is being explicitly targeted. This is just noise from some other infected computer on the net. As @rook says below, keep your system's patches current! – John Deters Nov 1 '16 at 5:13
  • Every webserver I run is relentlessly attacked with drive by style exploits. The good news... they are rarely even remotely applicable. Keep your systems and webapps patched and you will be fine. – trognanders Nov 1 '16 at 8:17
3

This use of null bytes is consitant with the Jetty Bleed attack. This attack discloses server memory, which contain's the HTTP reqeusts from other users (similar to hearbleed). This means that any passwords or secrets sent to this server maybe compromised.

Like any system, make sure you update.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.