[Xitami] xitami pro crashing (openssl vulnerability?)

[Bowden, Zeb]

The visit logs don't show any activity when the crash occurs, that's another thing that leads me to believe it's an openssl exploit ... if an attacker attacks me with an openssl exploit I won't see that in the logs because xitami will crash before it can record it in the logs ...
we've resorted to wrapping xitami in a batch file so that when it crashes it will dump a netstat -a to a file and then restart itself ... in the netstat dump you can see that port 443 is not open, port 80 still has some open connections, but 443 is no where to be found ...
you could conclude that it's a timing thing, however from looking in the logs I can see that there were some ssl connections to the web server within a minute of the crash ... so there should be some sign of those connections (at least a TIME_WAIT) still in the netstat ...

anyone know how to debug the crash log line?
smtssl:24: (3, 9)11/Aug/2003:13:31:31 -0500 Xitami v2.4d10

Thanks!



-----Original Message-----
From: Rob @ BMM [mailto:Rob@BlueMarbleMeds.com]
Sent: Tuesday, August 12, 2003 2:37 PM
To: xitami@lists.xitami.org
Subject: RE: [Xitami] xitami pro crashing (openssl vulnerability?)


This error may be unrelated.  I see these kinds of errors from time to time
in the crash log.  Check your site visit log to see what was happening at
that very moment of the crash.  Quite often, in my case, when Xitami decides
to blow up, there aren't any current site visitors that I can attribute the
cause to.

You'll probably just have to live with it.

Best Regards,
Rob Allen
President, Blue Marble Meds LLC.  Offering 30-85% off Prescription Meds
See us at http://www.BlueMarbleMeds.com
Call us for a quote - 480-836-7232, or Toll Free 866-247-8469



-----Original Message-----
From: xitami-admin@lists.xitami.org
[mailto:xitami-admin@lists.xitami.org]On Behalf Of Bowden, Zeb
Sent: Monday, August 11, 2003 10:37 AM
To: xitami@lists.xitami.org
Subject: [Xitami] xitami pro crashing (openssl vulnerability?)


does anyone have any idea what this means? it occurs in our crash.log....
Abort at smtssl:24: (3, 9)11/Aug/2003:13:31:31 -0500 Xitami v2.4d10
I know it's related to the openssl vulnerability but I can't pinpoint where
exactly it's happening....
anyone have any ideas?

Thanks!

Zeb Bowden
VT.IS&C.IAD.MIG:Application Developer
zbowden@vt.edu



--
Xitami Users Mailing List -- For Xitami support
To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami



--
Xitami Users Mailing List -- For Xitami support
To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami