[Xitami] DoS Bug still in v2.4d9 (W2K service)

[Jason Ozin at Technica Solutions]

Ewan says:

 > Interesting.  The current "fix" for the device names issue is to ask
 > Windows "is this a file" once we have opened the path in question.   If
 > it Windows says anything other than "this is a file", then we close it
 > and pretend we never saw it!

That is interesting. On all devices, sometimes I get a blank page returned
and sometimes I get a proper error message returned.

 > I'd be interested to know if the answer to that question is being
 > affected by whether there is something connected to the device or not.
 > (Eg, if you unplug whatever is plugging into LPT1/PRN does it still
 > happen?)

OK, physically removing the printer's cable does not help (still dies). But
removing it completely from Control Panel/Printers (or moving its port)
solves the problem completely.

Actually moving it to LPT2, in the OS and then issuing
http://<mydomin>/lpt2 does not bring the service down either but then I
haven't actually got a physical LPT2 so this may be an issue only when you
physically have a known device assigned to a real hardware port.

Jason Ozin
Technica Solutions