Is this website abuse ?

[jehoshua]

Hi,

The following from our web server logs:

219.65.238.129 - - [02/May/2005:05:02:29 -0400] "OPTIONS /A-personal-word-from-the-director.doc HTTP/1.1" 200 - "-" "Microsoft Data Access Internet Publishing Provider DAV 1.1"
219.65.238.129 - - [02/May/2005:05:03:11 -0400] "PROPFIND /A-personal-word-from-the-director.doc HTTP/1.1" 405 358 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"
219.65.238.129 - - [02/May/2005:05:03:12 -0400] "PROPFIND /A-personal-word-from-the-director.doc HTTP/1.1" 405 358 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"
219.65.238.129 - - [02/May/2005:05:03:20 -0400] "OPTIONS / HTTP/1.1" 200 - "-" "Microsoft Data Access Internet Publishing Provider Cache Manager"
219.65.238.129 - - [02/May/2005:05:03:21 -0400] "GET /_vti_inf.html HTTP/1.1" 302 312 "-" "Mozilla/2.0 (compatible; MS FrontPage 4.0)"
219.65.238.129 - - [02/May/2005:05:03:22 -0400] "POST /_vti_bin/shtml.exe/_vti_rpc HTTP/1.1" 302 312 "-" "MSFrontPage/4.0"
219.65.238.129 - - [02/May/2005:05:03:22 -0400] "OPTIONS /A-personal-word-from-the-director.doc HTTP/1.1" 200 - "-" "Microsoft Data Access Internet Publishing Provider DAV 1.1"
219.65.238.129 - - [02/May/2005:05:03:26 -0400] "PROPFIND /A-personal-word-from-the-director.doc HTTP/1.1" 405 358 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"
219.65.238.129 - - [02/May/2005:05:03:27 -0400] "PROPFIND /A-personal-word-from-the-director.doc HTTP/1.1" 405 358 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"
219.65.238.129 - - [02/May/2005:05:03:27 -0400] "OPTIONS / HTTP/1.1" 200 - "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"
219.65.238.129 - - [02/May/2005:05:03:28 -0400] "PROPFIND /A-personal-word-from-the-director.doc HTTP/1.1" 405 358 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"

We don't have Front Page extentensions installed, so why would this visitor be doing this one .......

219.65.238.129 - - [02/May/2005:05:03:22 -0400] "POST /_vti_bin/shtml.exe/_vti_rpc HTTP/1.1" 302 312 "-" "MSFrontPage/4.0"

and what is the PROPFIND method, is it a security exploit ?

Thanks,

Peter

[HarryR]

Hi,
Personally it just looks like somebody who's gotten mixed up and tried to edit a document and upload it to th site (or just not realizing that they can't change the document and let Windows do the rest).

Basicly WebDav handles the PROPFIND and PUT protocol methods to allow people to upload, browse and modify documents using a WebDav client. Having WebDav enabled on the server can be a risk (and a severe pain in the **** when trying to admin a FrontPage server), but if you don't have it enabled it poses no risk to you at all.

If you want to automaticly deny the PROPFIND and PUT methods just to feel a lilttle safer, you can use the following in your apache configuration:

<Limit GET POST HEAD>
   Order allow,deny
   Allow from all
</Limit>

<LimitExcept GET POST HEAD>
   Order deny,allow
   Deny from all
</Limit>

Regards,
- Harry