[Xitami] Code Red requests

[Craig Morrison]

John Poltorak wrote:
> 
> They said the worm is sent along as part of the GET request, and there is
> no requirement for a subsequent connection.

The bulk of the request is made up of the characters causing the buffer
overflow. It is possible, but I don't see how, considering the damage it can
do, in the remaining characters it can perform its "magic".

I've been wrong before, so if I am so be it.

> 
> I'm going to do a trace myself to see if I can confirm this.

I'd be interested in seeing the results. Off the list of course.

> 
> BTW is there any that XITAMI can be configured to perform a specific
> action depending on a request such "Get /default.ida..." ?

PHP, REXX or some type of CGI scripting would help here. You'd have to
associate *.ida documents to the scripting engine.

> 
> Or how could create a page which would satisfy this GET request?

Create a stock HTML document and save it as 'default.ida' in the webroot for
each domain. Then in defaults.cfg add:

[MIME]
    Ida=text/html

It works here, try it:

  http://www.2cah.com/default.ida?NNNNNNNNNNNNNNNNNNNNNN

-- 

Craig Morrison
  MTS Professional @ http://www.2cah.com/
  A Win32 Email server that works for _you_.
EzMTS - A _free_ Win32 EMail Server
  http://www.ezmts.org/
  Anonymous FTP at ftp://ftp.ezmts.org