[26534] in bugtraq
Clarification on Xitami DoS
daemon@ATHENA.MIT.EDU (Matthew Murphy)
Mon Aug 5 16:38:01 2002
Message-ID: <001101c23c05$b0510d00$e62d1c41@kc.rr.com>
From: "Matthew Murphy" <mattmurphy@kc.rr.com>
To: "SecurITeam News" <news@securiteam.com>,
"BugTraq" <bugtraq@securityfocus.com>,
"Full Disclosure" <full-disclosure@lists.netsys.com>
Date: Sun, 4 Aug 2002 17:24:24 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Due to conflicting results in some tests, I believe that my
previous post regarding this issue contained some inaccurate
statements:
The root cause of this vulnerability is not a sudden flood of
connections; the issue appears to be that Xitami 2.5 Beta does
not "clean up" the resources of a connection that has been
broken/closed in some cases. As a result, the vulnerability can
be triggered simply by heavy traffic.
Unsetting a limit you may have on HTTP connections will not
avoid this vulnerability, and could worsen the affects of any
actual overload. However, systems with limits set will exceed
those limits more quickly.
The vulnerability appears to be present in the way Xitami
handles Keep-Alive connections. Specifically, the server will
not close Keep-Alive connections even when appropriate
timeouts have been set.
"The reason the mainstream is thought
of as a stream is because it is
so shallow."
- Author Unknown
