[Ossec-list] Strange HTTP PUT requests

[danielcid at yahoo.com.br (Daniel Cid)]

Since yesterday I'm seeing some strange HTTP PUT
requests. It says it comes from "Microsoft Data Access
Internet Publishing Provider", so initially I tought
it were from someone with a misconfigured client or
something like that. However, now I'm seeing it from
multiple IPs. Is there any known vulnerability in any
server handling these requests? Have anyone seeing
this
kind of attempt too?

Sorry If i'm missing something obvious in here.

*first time I see these type of requests on my logs.

Portion of the logs:


69.9.175.242 - - [31/May/2006:15:53:44 -0300] "PUT
/default.htm HTTP/1.0" 405 321 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
69.9.175.242 - - [31/May/2006:15:53:44 -0300] "PUT
/default.asp HTTP/1.0" 405 321 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
69.9.175.242 - - [31/May/2006:15:53:43 -0300] "PUT
/index.asp HTTP/1.0" 405 319 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
69.9.175.242 - - [31/May/2006:15:53:43 -0300] "PUT
/index.htm HTTP/1.0" 405 319 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
69.9.175.242 - - [31/May/2006:15:53:35 -0300] "PUT
/default.htm HTTP/1.0" 405 321 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
69.9.175.242 - - [31/May/2006:15:53:35 -0300] "PUT
/default.asp HTTP/1.0" 405 321 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
64.214.127.143 - - [31/May/2006:18:00:16 -0300] "PUT
/default.htm HTTP/1.0" 405 321 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
64.214.127.143 - - [31/May/2006:18:00:16 -0300] "PUT
/default.asp HTTP/1.0" 405 321 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
64.214.127.143 - - [31/May/2006:18:00:16 -0300] "PUT
/index.asp HTTP/1.0" 405 319 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
64.214.127.143 - - [31/May/2006:18:00:16 -0300] "PUT
/index.htm HTTP/1.0" 405 319 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
64.214.127.143 - - [31/May/2006:18:00:03 -0300] "PUT
/default.htm HTTP/1.0" 405 321 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
67.18.222.66 - - [31/May/2006:21:39:54 -0300] "PUT
/index.asp HTTP/1.0" 405 319 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
67.18.222.66 - - [31/May/2006:21:39:53 -0300] "PUT
/index.asp HTTP/1.0" 405 319 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
67.18.222.66 - - [31/May/2006:21:39:53 -0300] "PUT
/index.htm HTTP/1.0" 405 319 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
67.18.222.66 - - [31/May/2006:21:39:53 -0300] "PUT
/index.htm HTTP/1.0" 405 319 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
67.18.222.66 - - [31/May/2006:21:39:49 -0300] "PUT
/default.htm HTTP/1.0" 405 320 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
67.18.222.66 - - [31/May/2006:21:39:49 -0300] "PUT
/default.htm HTTP/1.0" 405 320 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
67.18.222.66 - - [31/May/2006:21:39:49 -0300] "PUT
/default.asp HTTP/1.0" 405 320 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
67.18.222.66 - - [31/May/2006:22:41:52 -0300] "PUT
/default.htm HTTP/1.0" 405 321 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
67.18.222.66 - - [31/May/2006:22:41:52 -0300] "PUT
/default.asp HTTP/1.0" 405 321 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
67.18.222.66 - - [31/May/2006:22:41:52 -0300] "PUT
/index.asp HTTP/1.0" 405 319 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
67.18.222.66 - - [31/May/2006:22:41:52 -0300] "PUT
/index.htm HTTP/1.0" 405 319 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"
67.18.222.66 - - [31/May/2006:22:41:42 -0300] "PUT
/default.htm HTTP/1.0" 405 321 "-" "Microsoft Data
Access Internet Publishing Provider DAV 1.1"


Thanks,

--
Daniel B. Cid
dcid @ ( at ) ossec.net

__________________________________________________
Fale com seus amigos  de gra?a com o novo Yahoo! Messenger 
http://br.messenger.yahoo.com/