[Xitami] Imatix Xitami If-Modified-Since Remote Buffer Overflow Vulnerability

[Paul Reid]

 >> Are you going to rebuild the binaries?

 > it'll be a while, the build system is old and creaky.

FWIW, the website still has a July 2004 copy of 2.4

Nobody has a copy of old MSC? I used to, but I can't find it.

 > :-/  Surely there are alternatives to Xitami?

Nothing as clean and elegant as Xitami!!!!!

Going way back to the mid 1990s.... my boss wanted a webserver. I found 
a 386-25 w/8MB RAM. Someone said that Win NT 4 had a "free" webserver, 
and I used it. PWS, a cut-down of IIS. But I didn't like it. It smelled 
like hacker-bait to me (and as we now know, IIS was riddled with buffer 
and dot-dot vulnerabilities). It didn't do CGI (without ridiculous 
hacks), because they wanted you to use (buy) MS Studio to write MS-style 
applications. Configuration looked easier than it really was.

Someone gave me a 386 SX 16 with 2MB. It was an awful web surfer, but 
with XITAMI it turned out to be a much better web server. The only major 
flaw was W4WG 3.11's TCP stack falling down every week. A while later I 
moved it to a machine which would run the fairly stable NT stack, and 
that same day I had CGI programs working under Xitami. First raw DOS BAT 
files, then QuickBasic for DOS. I ported a major CGI to Visual Basic 
only for ease of large (>32KB) array handling.

Xitami is fairly easy to set up, even v-hosts and FTP. The HTTP service 
is very stable, the FTP service was reasonably stable until every ISP 
started filtering FTP. I always felt that MS IIS was written by 
enthusiastic children who did not understand that the internet is full 
of hostile attacks. I feel that Xitami was written with healthy 
skepticism, and history has shown this to be true.

However... events forced me to port my CGI to PHP on someone else's 
Apache server. Fine. Then I took over the server and tried to run Xitami 
with PHP. That works until you need CGI Server variables. Apache returns 
wrong (non-standard) variables. PHP has been coded to work with Apache. 
So after a no-joy day of trying to configure Xitami and PHP to run my 
CGI, I threw Apache on and it worked right away.

Apache on NT/XP O/S is very mature and quite stable. It has a vast 
audience and any new vulnerabilities get noticed and fixed real quick.

Setup of complex Apache servers is a major headache. One little typo in 
the conf file and you are hosed. I'd much rather play with Xitami than 
be a slave to Apache.

If not for the PHP thing, I might still be using Xitami everywhere.

As Magnus says, there ARE good alternatives, even on Windows, like 
lighttpd, Roxen, Yaws, etc.

Apache has no FTP server. I'm currently using FileZilla Server, which is 
undocumented but fairly easy to use.

 > Will this help any Pieter?

I think it needs more than a few $10 and 100E contributions to chain 
someone to the project long enough to understand the code. I've looked 
at it, and know I can't offer to maintain it, even if you paid me. I'd 
just mess it up. I'm not hearing that anybody else has looked at it. 
Pieter has better things to do (bravo on the MS award!).

  -PRR