[Xitami] strange things

[Paul Reid]

> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN.....

Someone discovered that if you send MS IIS webserver a VERY long packet,
the end of the packet over-writes part of the webserver code. 

The "NNNN..." is just filler. The gibberish at the end is the worm. It
corrupts part of IIS and loads the Code Red worm. See: 

   http://www.cert.org/advisories/CA-2001-23.html

There are patches for IIS that close this backdoor. 

Other webservers (including Xitami) correctly reply "Bad request" and
don't get infected. The attack is very specific to un-patched IIS
servers. It relies on both a buffer overflow and specific locations in
program memory. Even if a webserver had the buffer overflow, on non-IIS
servers the subroutines Code Red infects are not the same, nor in the
same places. 

Even though Code Red does not infest Xitami, a Code Red server anywhere
in the world can swamp the network. It appears that much of my campus
was dead-slow overnight, though I have not confirmed that it was someone
else's Code Red trying to hit us. 

> My server would be hard pressed, however, to consume 5GB in logs 

However, my WinNT machine got sluggish when I had thousands of daily
logs in one folder. 

Xitami was just a hair slow, but NT file explorer was so slow that I
finally had to bring the machine off-line (so the logs were not growing
while I was working) and copy them off to subfolders. 

 -PRR